Vulnerabilidades em SUSE

253 resultados
Análise Vexday

Com 193 CVEs catalogadas, o portfólio de vulnerabilidades da SUSE apresenta uma taxa de exploração ativa abaixo da média geral do catálogo, sem nenhum registro no CISA KEV, o que sugere menor exposição imediata a ataques confirmados. Ainda assim, 26 falhas de severidade crítica merecem atenção contínua, especialmente CVE-2025-46811, que concentra o maior escore EPSS observado (0,1032) e representa o risco mais elevado de exploração no curto prazo. A falha mais recorrente por tipo é CWE-276 (permissões padrão incorretas), um padrão que frequentemente decorre de configurações inadequadas durante implantação ou atualização de pacotes. Com apenas 2 CVEs com PoC pública e 9 surgidas nos últimos 90 dias, equipes de segurança devem manter ciclos de patching ativos, priorizando as críticas e monitorando a evolução do EPSS para as mais recentes.

CVE-2026-75033HIGHRancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation SpoofingEPSS 0.3%CVE-2019-3688MEDIUMsquid: /usr/sbin/pinger packaged with wrong permissionEPSS 0.3%CVE-2017-9271MEDIUMproxy credentials written to log files by zypperEPSS 0.3%CVE-2023-32198HIGHSteve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacksEPSS 0.3%CVE-2024-49504HIGHgrub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted ImagesEPSS 0.3%CVE-2026-75034HIGHRancher: SAML Assertion ReplayEPSS 0.3%CVE-2026-88809HIGHRancher meta proxy allowlist bypass leading to server-side request forgeryEPSS 0.3%CVE-2018-17954CRITICALcrowbar provision leaks admin password to all nodes in cleartextEPSS 0.3%CVE-2021-31998MEDIUMinn: %post calls user owned file allowing local privilege escalation to rootEPSS 0.3%CVE-2018-19636HIGHLocal root exploit via inclusion of attacker controlled shell scriptEPSS 0.3%CVE-2020-8013LOWpermissions: chkstat sets unintended setuid/capabilities for mrsh and wodimEPSS 0.3%CVE-2021-25316LOWLocal DoS of VM live migration due to use of static tmp files in detach_disks.sh in s390-toolsEPSS 0.3%CVE-2019-18900MEDIUMlibzypp stores cookies world readableEPSS 0.3%CVE-2019-3682HIGHInsecure API port exposed to all Master Node guest containersEPSS 0.3%CVE-2018-17955LOWStatic tempfile name allows overwriting of arbitrary filesEPSS 0.3%CVE-2026-93537MEDIUMPath traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directoryEPSS 0.3%CVE-2020-8027HIGHopenldap uses fixed paths in /tmpEPSS 0.3%CVE-2021-32001MEDIUMK3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a tokenEPSS 0.3%CVE-2023-32182MEDIUMA Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUEPSS 0.3%CVE-2018-19640MEDIUMCode execution if run with command line switch -vEPSS 0.3%