How many SUSE openSUSE Tumbleweed CVEs are in CISA KEV?

None of SUSE openSUSE Tumbleweed's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of SUSE openSUSE Tumbleweed are affected?

26 distinct SUSE openSUSE Tumbleweed versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in SUSE openSUSE Tumbleweed CVEs?

SUSE openSUSE Tumbleweed's CVEs most often map to these CWE weakness types: CWE-61 (UNIX Symbolic Link (Symlink) Following), CWE-276 (Incorrect Default Permissions), CWE-732 (Incorrect Permission Assignment for Critical Resource), CWE-754 (Improper Check for Unusual or Exceptional Conditions).

How many critical SUSE openSUSE Tumbleweed vulnerabilities are there?

SUSE openSUSE Tumbleweed has 1 critical and 5 high-severity CVEs.

What is the average severity of SUSE openSUSE Tumbleweed CVEs?

The average CVSS base score across SUSE openSUSE Tumbleweed's scored CVEs is 6.7.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

SUSE

12 CVEs

SUSE openSUSE Tumbleweed Vulnerabilities

Name: SUSE openSUSE Tumbleweed vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for openSUSE Tumbleweed by SUSE.

12

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

2

Public exploits

PoC or exploit code

6.7

Avg CVSS

2024–2026

Last updated July 14, 2026

Overview

SUSE openSUSE Tumbleweed has 12 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 6.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting SUSE openSUSE Tumbleweed, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of SUSE openSUSE Tumbleweed's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High5

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of SUSE openSUSE Tumbleweed's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2

2 of SUSE openSUSE Tumbleweed's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every SUSE openSUSE Tumbleweed version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

? <= v < 0.2.1-1.11 CVE
? <= v < 0.26-37.11 CVE
? <= v < 1.9.0-1.11 CVE
? <= v < 2.0+git.1600444747.83b3644-3.11 CVE
? <= v < 2.12-28.11 CVE
? <= v < 2.5.0-1.11 CVE
? <= v < 3.3.10-2.11 CVE
? <= v < 3.8.4-2.11 CVE
? <= v < 7.8.0p0-1.11 CVE
? <= v < 8.0.5-2.11 CVE
? <= v < 9.0.85-3.11 CVE
< 0.26-37.11 CVE
< 1.0.831 CVE
< 2.12-28.11 CVE

Fixed in

0.2.1-1.11 CVE
0.26-37.11 CVE
1.0.831 CVE
1.9.0-1.11 CVE
2.0+git.1600444747.83b3644-3.11 CVE
2.12-28.11 CVE
2.5.0-1.11 CVE
3.3.10-2.11 CVE
3.8.4-2.11 CVE
7.8.0p0-1.11 CVE
8.0.5-2.11 CVE
9.0.85-3.11 CVE

Find a version

12 CVEs

Sort

LPE from suricata user to root due to chown in %post in suricata packaging
CVE-2026-59674
Patch
CWE-61
High · CVSS 7.1
EPSS 0.1% (3th pct)2026-07-14
csync2 uses insecure temporary directories when compiled with C99 or later
CVE-2026-41051
Patch
CWE-367
Medium · CVSS 5.1
EPSS 0.1% (0th pct)2026-05-13
Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock
CVE-2025-62875
Public exploit
Patch
CWE-754
Medium · CVSS 6.9
EPSS 0.2% (7th pct)2025-11-20
The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess
CVE-2025-53882
Patch
CWE-807
Medium · CVSS 4.8
EPSS 0.1% (3th pct)2025-07-23
daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root
CVE-2025-23394
Patch
CWE-61
Critical · CVSS 9.8
EPSS 0.5% (39th pct)2025-05-26
gerbera: Privilege escalation from user gerbera to root because of insecure %post script
CVE-2025-23386
Patch
CWE-276
High · CVSS 7.8
EPSS 0.1% (4th pct)2025-04-10
grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images
CVE-2024-49504
Patch
CWE-276
High · CVSS 7.0
EPSS 0.3% (25th pct)2024-11-13
XSS vulnerability found in OpenSuse MirrorCache
CVE-2024-49505
Public exploit
Patch
CWE-79
Medium · CVSS 5.3
EPSS 0.3% (25th pct)2024-11-13
Medium vulnerability · 2024-10-16
CVE-2024-22034
Patch
Medium · CVSS 5.5
EPSS 0.2% (11th pct)2024-10-16
Medium vulnerability · 2024-10-16
CVE-2024-22033
Patch
CWE-78
Medium · CVSS 5.1
EPSS 0.9% (57th pct)2024-10-16
tomcat packaging allows for escalation to root from tomcat user
CVE-2024-22029
Patch
CWE-732
High · CVSS 7.8
EPSS 0.2% (8th pct)2024-10-16
mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable
CVE-2023-32190
Patch
CWE-125
High · CVSS 8.5
EPSS 0.2% (10th pct)2024-10-16

Common weakness types

The CWE weakness categories most often found in SUSE openSUSE Tumbleweed CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many SUSE openSUSE Tumbleweed CVEs were published each year.

2024

6

2025

4

2026

2

Other SUSE products

Browse vulnerabilities for other products by SUSE.

kernel-devel11,898 CVEs kernel-source11,788 CVEs kernel-macros11,404 CVEs kernel-default11,398 CVEs kernel-syms11,398 CVEs kernel-default-devel11,359 CVEs kernel-docs11,058 CVEs kernel-rt10,877 CVEs

All SUSE vulnerabilities

Frequently asked questions

Common questions about SUSE openSUSE Tumbleweed vulnerabilities.

How many CVEs does SUSE openSUSE Tumbleweed have?: SUSE openSUSE Tumbleweed has 12 published CVE records since 2024.
How many SUSE openSUSE Tumbleweed CVEs are in CISA KEV?: None of SUSE openSUSE Tumbleweed's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for SUSE openSUSE Tumbleweed vulnerabilities?: Yes — 2 of SUSE openSUSE Tumbleweed's CVEs have a known public exploit.
Which versions of SUSE openSUSE Tumbleweed are affected?: 26 distinct SUSE openSUSE Tumbleweed versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in SUSE openSUSE Tumbleweed CVEs?: SUSE openSUSE Tumbleweed's CVEs most often map to these CWE weakness types: CWE-61 (UNIX Symbolic Link (Symlink) Following), CWE-276 (Incorrect Default Permissions), CWE-732 (Incorrect Permission Assignment for Critical Resource), CWE-754 (Improper Check for Unusual or Exceptional Conditions).
How many critical SUSE openSUSE Tumbleweed vulnerabilities are there?: SUSE openSUSE Tumbleweed has 1 critical and 5 high-severity CVEs.
What is the average severity of SUSE openSUSE Tumbleweed CVEs?: The average CVSS base score across SUSE openSUSE Tumbleweed's scored CVEs is 6.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track SUSE openSUSE Tumbleweed vulnerabilities

Monitor new SUSE openSUSE Tumbleweed vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing