CVE-2026-41051: medium-severity vulnerability in SUSE openSUSE Tumbleweed
csync2 uses insecure temporary directories when compiled with C99 or later
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.1%
exploitation probability
0.1%top 100% of all CVEs
observed exploitation
nono source reports it
csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
SUSE · openSUSE TumbleweedRelated CVEs — SUSE openSUSE Tumbleweed
In the same product, most dangerous first.
CVE-2024-22033MEDIUMobs-service-download_url is vulnerable to argument injectionEPSS 0.9%CVE-2025-23394CRITICALdaily-backup.sh script in cyrus-imapd allows escalation from cyrus to rootEPSS 0.6%CVE-2024-49504HIGHgrub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted ImagesEPSS 0.3%CVE-2026-44950CRITICALfs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2EPSS 0.3%CVE-2026-59679CRITICALfs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2EPSS 0.3%CVE-2024-22034MEDIUMCrafted projects can overwrite special files in the .osc config directoryEPSS 0.2%