Vulnerabilidades em SUSE

253 resultados
Análise Vexday

Com 193 CVEs catalogadas, o portfólio de vulnerabilidades da SUSE apresenta uma taxa de exploração ativa abaixo da média geral do catálogo, sem nenhum registro no CISA KEV, o que sugere menor exposição imediata a ataques confirmados. Ainda assim, 26 falhas de severidade crítica merecem atenção contínua, especialmente CVE-2025-46811, que concentra o maior escore EPSS observado (0,1032) e representa o risco mais elevado de exploração no curto prazo. A falha mais recorrente por tipo é CWE-276 (permissões padrão incorretas), um padrão que frequentemente decorre de configurações inadequadas durante implantação ou atualização de pacotes. Com apenas 2 CVEs com PoC pública e 9 surgidas nos últimos 90 dias, equipes de segurança devem manter ciclos de patching ativos, priorizando as críticas e monitorando a evolução do EPSS para as mais recentes.

CVE-2021-25314HIGHhawk: Insecure file permissionsEPSS 0.4%CVE-2023-32192HIGHRancher API Server Cross-site Scripting VulnerabilityEPSS 0.4%CVE-2024-22032HIGHRancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpecEPSS 0.4%CVE-2024-52283MEDIUMMissing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain projectEPSS 0.4%CVE-2025-62879MEDIUMRancher Backup Operator pod's logs leak S3 tokensEPSS 0.4%CVE-2018-17957LOWyast2-rmt leaks database passwords in process listEPSS 0.4%CVE-2025-23392MEDIUMReflected XSS in SystemsController.java in spacewalk-javaEPSS 0.4%CVE-2026-25705HIGHRancher Extensions have arbitrary file access via path traversalEPSS 0.4%CVE-2026-71403MEDIUMRancher: Identity-field mutation in /v3/users allows account hijack via principal rebindEPSS 0.4%CVE-2025-23393MEDIUMReflected XSS in spacewalk-javaEPSS 0.4%CVE-2019-3693HIGHLocal privilege escalation from user wwwrun to root in the packaging of mailmanEPSS 0.4%CVE-2026-78425HIGHSAML Audience Confusion Allows Cross-SP AuthenticationEPSS 0.4%CVE-2025-54468MEDIUMRancher sends sensitive information to external services through the `/meta/proxy` endpointEPSS 0.4%CVE-2025-66001HIGHNeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)EPSS 0.4%CVE-2026-44932HIGHindirect remote shell command injection via unsanitized DHCP options in wickedEPSS 0.4%CVE-2026-44936MEDIUMRancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlEPSS 0.3%CVE-2025-46808MEDIUMSensitive information is leaked into NeuVector’s manager container logsEPSS 0.3%CVE-2026-55998MEDIUMCluster Existence Oracle via Unauthenticated Import EndpointEPSS 0.3%CVE-2018-17956LOWPassword exposed in process listingEPSS 0.3%CVE-2026-75035HIGHRancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypassEPSS 0.3%