Skip to content
Noroxi

openSUSE records

3,297 published records for vendor openSUSE. 61 of them have been exploited in the wild (listed in CISA KEV) and 87 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
61 · 1.9%
Weaponized
87 · 2.6%
Pre-auth RCE
417
With a fix record
89.5%
Median publish → KEV
2627 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

3,297 records
  • CVE-2015-3306
    100Now

    The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    proftpd · proftpdMay 18, 2015

  • CVE-2014-6271
    99Now

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attac

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    gnu · bashSep 24, 2014

  • CVE-2012-1823
    99Now

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle que

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    php · phpMay 11, 2012

  • CVE-2014-7169
    99Now

    GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variabl

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    gnu · bashSep 24, 2014

  • CVE-2014-0497
    99Now

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerFeb 5, 2014

  • CVE-2015-3113
    99Now

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerJun 23, 2015

  • CVE-2020-16846
    99Now

    An issue was discovered in SaltStack Salt through 3002.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    saltstack · saltNov 6, 2020

  • CVE-2020-1938
    99Now

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · geodeFeb 24, 2020

  • CVE-2015-5119
    99Now

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    adobe · flash playerJul 8, 2015

  • CVE-2013-0422
    98Now

    Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBean

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    oracle · jdkJan 10, 2013

  • CVE-2020-11651
    98Now

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    saltstack · saltApr 30, 2020

  • CVE-2010-0840
    98Now

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    oracle · jreApr 1, 2010

  • CVE-2015-0313
    98Now

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    adobe · flash playerFeb 2, 2015

  • CVE-2016-4117
    97Now

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wil

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    adobe · flash playerMay 10, 2016

  • CVE-2016-3427
    97Now

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to aff

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    oracle · jdkApr 21, 2016

  • CVE-2011-0611
    95Now

    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    adobe · flash playerApr 13, 2011

  • CVE-2015-5122
    95Now

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    adobe · flash playerJul 14, 2015

  • CVE-2020-12641
    94Now

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    roundcube · webmailMay 4, 2020

  • CVE-2016-3714
    92Now

    The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x befor

    HighCVSS 8.4KEVWeaponizedEPSS 97%

    imagemagick · imagemagickMay 5, 2016

  • CVE-2015-3043
    91Now

    Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows att

    CriticalCVSS 9.8KEVWeaponizedEPSS 73%

    adobe · flash playerApr 14, 2015

  • CVE-2010-4344
    91Now

    Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code

    CriticalCVSS 9.8KEVWeaponizedEPSS 71%

    exim · eximDec 14, 2010

  • CVE-2014-0160
    90Now

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    openssl · opensslApr 7, 2014

  • CVE-2015-5477
    90Now

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion fa

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    isc · bindJul 29, 2015

  • CVE-2019-5418
    90Now

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accep

    HighCVSS 7.5KEVWeaponizedEPSS 98%

    rubyonrails · railsMar 27, 2019

  • CVE-2026-31431
    90Now

    crypto: algif_aead - Revert to operating out-of-place

    HighCVSS 7.8KEVWeaponizedEPSS 98%

    linux · linux kernelApr 22, 2026