cvelistv5 - cve-2025-52997

CVE-2025-52997 (GCVE-0-2025-52997)

Vulnerability from cvelistv5 – Published: 2025-06-30 20:05 – Updated: 2025-08-04 17:38

Summary

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts
CWE-521 - Weak Password Requirements
CWE-1392 - Use of Default Credentials

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	filebrowser	filebrowser	Affected: < 2.34.1

FKIE_CVE-2025-52997

Vulnerability from fkie_nvd - Published: 2025-06-30 20:15 - Updated: 2025-08-04 18:15

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c	Patch
security-advisories@github.com	https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7gg	Exploit, Vendor Advisory
security-advisories@github.com	https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_Handling

Impacted products

	Vendor	Product	Version
	filebrowser	filebrowser	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "722408D2-65E2-422E-8B39-30C43A569C5C",
              "versionEndExcluding": "2.34.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1."
    },
    {
      "lang": "es",
      "value": "File Browser proporciona una interfaz de gesti\u00f3n de archivos dentro de un directorio espec\u00edfico y permite cargar, eliminar, previsualizar, renombrar y editar archivos. Antes de la versi\u00f3n 2.34.1, la falta de una pol\u00edtica de contrase\u00f1as y la protecci\u00f3n contra ataques de fuerza bruta hac\u00edan inseguro el proceso de autenticaci\u00f3n. Los atacantes pod\u00edan realizar un ataque de fuerza bruta para recuperar las contrase\u00f1as de todas las cuentas en una instancia dada. Este problema se ha corregido en la versi\u00f3n 2.34.1."
    }
  ],
  "id": "CVE-2025-52997",
  "lastModified": "2025-08-04T18:15:35.313",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-06-30T20:15:25.847",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7gg"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_Handling"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        },
        {
          "lang": "en",
          "value": "CWE-521"
        },
        {
          "lang": "en",
          "value": "CWE-1392"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CM2R-RG7R-P7GG

Vulnerability from github – Published: 2025-06-30 17:50 – Updated: 2025-08-04 17:39

Summary

File Browser vulnerable to insecure password handling

Details

Summary

All user accounts authenticate towards a File Browser instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process.

Impact

Attackers can mount a brute-force attack against the passwords of all accounts of an instance. Since the application is lacking the ability to prevent users from choosing a weak password, the attack is likely to succeed.

Vulnerability Description

The application implement a classical authentication scheme using a username and password combination. While employed by many systems, this scheme is quite error-prone and a common cause for vulnerabilities. File Browser's implementation has multiple weak points:

Since the application is missing the capability for administrators to define a password policy, users are at liberty to set trivial and well-known passwords such as secret or even ones with only single digit like 1.
New instances are set up with a default password of admin for the initial administrative account. This password is well known and easily guessable. While the documentation advises to change this password, the application does not technically enforce it.
The application does not implement any brute-force protection for the authentication endpoint. Attackers can make as many guesses for a password as the network bandwidth allows.

The combination of these problems makes it likely, that an attacker will succeed in compromising at least one account in a File Browser instance, possibly even one with administrative privileges. The likelihood of such an attack increases substantially for internet-facing instances.

Proof of Concept

The insecure default credentials are documented on the application's website:

The following HTTP communication shows, that a trivial password of 1 can be configured by a user:

```http hl:17 PUT /api/users/2 HTTP/1.1 Host: filebrowser.local:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: http://filebrowser.local:8080/settings/profile X-Auth: eyJ[...] Content-Type: text/plain;charset=UTF-8 Content-Length: 319 Origin: http://filebrowser.local:8080 Connection: keep-alive Cookie: auth=eyJ[...] X-PwnFox-Color: cyan Priority: u=0

{"what":"user","which":["password"],"data":{"id":2,"locale":"en","viewMode":"mosaic","singleClick":false,"perm":{"admin":false,"execute":true,"create":true,"rename":true,"modify":true,"delete":true,"share":true,"download":true},"commands":[],"lockPassword":false,"hideDotfiles":false,"dateFormat":false,"password":"1"}}

HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Security-Policy: default-src 'self'; style-src 'unsafe-inline'; Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 27 Mar 2025 08:31:34 GMT Content-Length: 7

200 OK


The missing brute-force protection can easily be tested by repeatedly sending the following request to the application with a tool such as Burp or hydra.

POST /api/login HTTP/1.1 Host: filebrowser.local:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/json Content-Length: 52 Origin: http://filebrowser.local:8080

{"username":"admin","password":"myPasswordGuess","recaptcha":""}

HTTP/1.1 403 Forbidden Cache-Control: no-cache, no-store, must-revalidate Content-Security-Policy: default-src 'self'; style-src 'unsafe-inline'; Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 27 Mar 2025 08:39:48 GMT Content-Length: 14

403 Forbidden


After sending 3000 bad passwords to the application within a few seconds, a successful authentication is still possible for the account:

```http
POST /api/login HTTP/1.1
Host: filebrowser.local:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 54
Origin: http://filebrowser.local:8080
Connection: keep-alive

{"username":"admin","password":"myCorrectPassword","recaptcha":""}

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Security-Policy: default-src 'self'; style-src 'unsafe-inline';
Content-Type: text/plain
Date: Thu, 27 Mar 2025 08:39:58 GMT
Content-Length: 508

eyJ[...]

Recommended Countermeasures

The application should add an option to define a password policy in its administrative interface which allows to set a minimum length for passwords. The default settings should be in line with the NIST publication SP 800-63B. This means, that now passwords of fewer than 8 characters should ever be allowed by the application. Whenever a user sets a new password, the application should verify whether that password is part of a "known passwords" list.

The application should either create a secure and random password for the admin account upon initialization or enforce an immediate password change when that user logs in for the first time using the default password.

A brute-force protection needs to be implemented, which limits the allowed amount of authentication attempts per user within a certain timeframe. This implementation should employ device tokens to prevent targeted lockout attacks.

In addition, it would be advisable to allow the integration of the application into and existing Identity Provider using protocols like LDAP or OIDC.

Timeline

2025-03-27 Identified the vulnerability in version 2.32.0
2025-04-11 Contacted the project
2025-04-29 Vulnerability disclosed to the project
2025-06-25 Uploaded advisories to the project's GitHub repository
2025-06-26 CVE ID assigned by GitHub
2025-06-29 Fix released in version 2.34.1. 12 minimum characters as default has been chosen since the implementation does not include protection against brute force attacks.

References

Credits

Mathias Tausig (SBA Research)

Severity ?

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.34.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.34.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-52997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1392",
      "CWE-307",
      "CWE-521"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-30T17:50:01Z",
    "nvd_published_at": "2025-06-30T20:15:25Z",
    "severity": "MODERATE"
  },
  "details": "## Summary ##\n\nAll user accounts authenticate towards a *File Browser* instance with a password. A missing password policy and brute-force protection makes it impossible for administrators to properly secure the authentication process.\n\n## Impact ##\n\nAttackers can mount a brute-force attack against the passwords of all accounts of an instance. Since the application is lacking the ability to prevent users from choosing a weak password, the attack is likely to succeed.\n\n## Vulnerability Description ##\n\nThe application implement a classical authentication scheme using a username and password combination. While employed by many systems, this scheme is quite error-prone and a common cause for vulnerabilities. File Browser\u0027s implementation has multiple weak points:\n\n1. Since the application is missing the capability for administrators to define a password policy, users are at liberty to set trivial and well-known passwords such as `secret` or even ones with only single digit like `1`.\n2. New instances are set up with a default password of `admin` for the initial administrative account. This password is well known and easily guessable. While the documentation advises to change this password, the application does not technically enforce it.\n3. The application does not implement any brute-force protection for the authentication endpoint. Attackers can make as many guesses for a password as the network bandwidth allows.\n\nThe combination of these problems makes it likely, that an attacker will succeed in compromising at least one account in a *File Browser* instance, possibly even one with administrative privileges. The likelihood of such an attack increases substantially for internet-facing instances.\n\n## Proof of Concept ##\n\nThe insecure default credentials are documented on the application\u0027s website:\n\n![image](https://github.com/user-attachments/assets/46c07d99-dc7b-4d6e-ac27-7eb002229201)\n\nThe following HTTP communication shows, that a trivial password of `1` can be configured by a user:\n\n```http hl:17\nPUT /api/users/2 HTTP/1.1\nHost: filebrowser.local:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: http://filebrowser.local:8080/settings/profile\nX-Auth: eyJ[...]\nContent-Type: text/plain;charset=UTF-8\nContent-Length: 319\nOrigin: http://filebrowser.local:8080\nConnection: keep-alive\nCookie: auth=eyJ[...]\nX-PwnFox-Color: cyan\nPriority: u=0\n\n{\"what\":\"user\",\"which\":[\"password\"],\"data\":{\"id\":2,\"locale\":\"en\",\"viewMode\":\"mosaic\",\"singleClick\":false,\"perm\":{\"admin\":false,\"execute\":true,\"create\":true,\"rename\":true,\"modify\":true,\"delete\":true,\"share\":true,\"download\":true},\"commands\":[],\"lockPassword\":false,\"hideDotfiles\":false,\"dateFormat\":false,\"password\":\"1\"}}\n\nHTTP/1.1 200 OK\nCache-Control: no-cache, no-store, must-revalidate\nContent-Security-Policy: default-src \u0027self\u0027; style-src \u0027unsafe-inline\u0027;\nContent-Type: text/plain; charset=utf-8\nX-Content-Type-Options: nosniff\nDate: Thu, 27 Mar 2025 08:31:34 GMT\nContent-Length: 7\n\n200 OK\n```\n\nThe missing brute-force protection can easily be tested by repeatedly sending the following request to the application with a tool such as Burp or hydra.\n\n```\nPOST /api/login HTTP/1.1\nHost: filebrowser.local:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/json\nContent-Length: 52\nOrigin: http://filebrowser.local:8080\n\n{\"username\":\"admin\",\"password\":\"myPasswordGuess\",\"recaptcha\":\"\"}\n\nHTTP/1.1 403 Forbidden\nCache-Control: no-cache, no-store, must-revalidate\nContent-Security-Policy: default-src \u0027self\u0027; style-src \u0027unsafe-inline\u0027;\nContent-Type: text/plain; charset=utf-8\nX-Content-Type-Options: nosniff\nDate: Thu, 27 Mar 2025 08:39:48 GMT\nContent-Length: 14\n\n403 Forbidden\n```\n\nAfter sending 3000 bad passwords to the application within a few seconds, a successful authentication is still possible for the account:\n\n```http\nPOST /api/login HTTP/1.1\nHost: filebrowser.local:8080\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nContent-Type: application/json\nContent-Length: 54\nOrigin: http://filebrowser.local:8080\nConnection: keep-alive\n\n{\"username\":\"admin\",\"password\":\"myCorrectPassword\",\"recaptcha\":\"\"}\n\nHTTP/1.1 200 OK\nCache-Control: no-cache, no-store, must-revalidate\nContent-Security-Policy: default-src \u0027self\u0027; style-src \u0027unsafe-inline\u0027;\nContent-Type: text/plain\nDate: Thu, 27 Mar 2025 08:39:58 GMT\nContent-Length: 508\n\neyJ[...]\n```\n\n## Recommended Countermeasures ##\n\nThe application should add an option to define a password policy in its administrative interface which allows to set a minimum length for passwords.\nThe default settings should be in line with the NIST publication SP 800-63B. This means, that now passwords of fewer than 8 characters should ever be allowed by the application.\nWhenever a user sets a new password, the application should verify whether that password is part of a \"known passwords\" list.\n\nThe application should either create a secure and random password for the `admin` account upon initialization or enforce an immediate password change when that user logs in for the first time using the default password.\n\nA brute-force protection needs to be implemented, which limits the allowed amount of authentication attempts per user within a certain timeframe. This implementation should employ *device tokens* to prevent targeted lockout attacks.\n\nIn addition, it would be advisable to allow the integration of the application into and existing *Identity Provider* using protocols like LDAP or OIDC.\n\n## Timeline ##\n\n* `2025-03-27` Identified the vulnerability in version 2.32.0\n* `2025-04-11` Contacted the project\n* `2025-04-29` Vulnerability disclosed to the project\n* `2025-06-25` Uploaded advisories to the project\u0027s GitHub repository\n* `2025-06-26` CVE ID assigned by GitHub\n* `2025-06-29` Fix released in version 2.34.1. 12 minimum characters as default has been chosen since the implementation does not include protection against brute force attacks. \n\n## References ##\n\n* [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#implement-proper-password-strength-controls)\n* [NIST Special Publication 800-63B. Digital Identity Guidelines. Passwords](https://pages.nist.gov/800-63-4/sp800-63b.html#password)\n* [Pwned Passwords](https://haveibeenpwned.com/Passwords)\n* [Common Credentials](https://github.com/danielmiessler/SecLists/tree/master/Passwords/Common-Credentials)\n* [CWE-307: Improper Restriction of Excessive Authentication Attempts](https://cwe.mitre.org/data/definitions/307.html)\n* [CWE-521: Weak Password Requirements](https://cwe.mitre.org/data/definitions/521.html)\n* [CWE-1392: Use of Default Credentials](https://cwe.mitre.org/data/definitions/1392.html)\n* [Original Advisory](https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_Handling)\n\n## Credits ##\n\n* Mathias Tausig ([SBA Research](https://www.sba-research.org/))",
  "id": "GHSA-cm2r-rg7r-p7gg",
  "modified": "2025-08-04T17:39:31Z",
  "published": "2025-06-30T17:50:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-cm2r-rg7r-p7gg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52997"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-01_Filebrowser_Insecure_Password_Handling"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3792"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Browser vulnerable to insecure password handling"
}

CNVD-2025-22705

Vulnerability from cnvd - Published: 2025-09-26

Title

FileBrowser存在未明漏洞（CNVD-2025-22705）

Description

FileBrowser是开源的一款网页文件浏览器。提供指定目录下的文件管理界面，可用于上传、删除、预览、重命名和编辑您的文件。 FileBrowser存在安全漏洞，该漏洞源于缺少密码策略和暴力破解保护，攻击者可利用该漏洞导致账户密码泄露。

Severity

高

Patch Name

FileBrowser存在未明漏洞（CNVD-2025-22705）的补丁

Patch Description

FileBrowser是开源的一款网页文件浏览器。提供指定目录下的文件管理界面，可用于上传、删除、预览、重命名和编辑您的文件。 FileBrowser存在安全漏洞，该漏洞源于缺少密码策略和暴力破解保护，攻击者可利用该漏洞导致账户密码泄露。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/filebrowser/filebrowser/releases

Reference

https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c

Impacted products

Name
filebrowser filebrowser <2.34.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-52997",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-52997"
    }
  },
  "description": "FileBrowser\u662f\u5f00\u6e90\u7684\u4e00\u6b3e\u7f51\u9875\u6587\u4ef6\u6d4f\u89c8\u5668\u3002\u63d0\u4f9b\u6307\u5b9a\u76ee\u5f55\u4e0b\u7684\u6587\u4ef6\u7ba1\u7406\u754c\u9762\uff0c\u53ef\u7528\u4e8e\u4e0a\u4f20\u3001\u5220\u9664\u3001\u9884\u89c8\u3001\u91cd\u547d\u540d\u548c\u7f16\u8f91\u60a8\u7684\u6587\u4ef6\u3002\n\nFileBrowser\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f3a\u5c11\u5bc6\u7801\u7b56\u7565\u548c\u66b4\u529b\u7834\u89e3\u4fdd\u62a4\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8d26\u6237\u5bc6\u7801\u6cc4\u9732\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/filebrowser/filebrowser/releases",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-22705",
  "openTime": "2025-09-26",
  "patchDescription": "FileBrowser\u662f\u5f00\u6e90\u7684\u4e00\u6b3e\u7f51\u9875\u6587\u4ef6\u6d4f\u89c8\u5668\u3002\u63d0\u4f9b\u6307\u5b9a\u76ee\u5f55\u4e0b\u7684\u6587\u4ef6\u7ba1\u7406\u754c\u9762\uff0c\u53ef\u7528\u4e8e\u4e0a\u4f20\u3001\u5220\u9664\u3001\u9884\u89c8\u3001\u91cd\u547d\u540d\u548c\u7f16\u8f91\u60a8\u7684\u6587\u4ef6\u3002\r\n\r\nFileBrowser\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f3a\u5c11\u5bc6\u7801\u7b56\u7565\u548c\u66b4\u529b\u7834\u89e3\u4fdd\u62a4\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8d26\u6237\u5bc6\u7801\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "FileBrowser\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2025-22705\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "filebrowser filebrowser \u003c2.34.1"
  },
  "referenceLink": "https://github.com/filebrowser/filebrowser/commit/bf37f88c32222ad9c186482bb97338a9c9b4a93c",
  "serverity": "\u9ad8",
  "submitTime": "2025-07-04",
  "title": "FileBrowser\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2025-22705\uff09"
}

OPENSUSE-SU-2025:15405-1

Vulnerability from csaf_opensuse - Published: 2025-08-04 00:00 - Updated: 2025-08-04 00:00

Summary

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

Notes

Title of the patch

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

Description of the patch

These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2025-15405

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15405",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15405-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44905 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44905/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-44906 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-44906/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-56731 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-56731/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-0928 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-0928/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-1088 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-1088/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-30086 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-30086/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-32019 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-32019/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3227 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3227/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3228 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3228/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3415 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3415/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4563 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4563/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4656 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4656/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46702 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46702/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4674 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4674/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47281 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47281/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47871 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47871/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47943 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47943/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4922 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4922/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-4981 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-4981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-49825 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-49825/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-5030 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-5030/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-51471 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-51471/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52477 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52477/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52889 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52889/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52890 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52890/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52893 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52893/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52894 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52894/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52900 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52900/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52901 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52901/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52902 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52902/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52903 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52903/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52904 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52904/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52995 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52995/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52996 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-52997 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-52997/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53512 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53512/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53513 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53513/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53547 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53547/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53632 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53632/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53633 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53633/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53634 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53634/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53826 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53826/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53893 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53893/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53945 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53945/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54059 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54059/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-54379 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-54379/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-5689 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-5689/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-5981 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-5981/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6023 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6023/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6032 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6032/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6224 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6224/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6226 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6226/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6227 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6227/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6233 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6233/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6264 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6264/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6624 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6624/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-08-04T00:00:00Z",
      "generator": {
        "date": "2025-08-04T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15405-1",
      "initial_release_date": "2025-08-04T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-08-04T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20250730T213748-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-44905",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44905"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44905",
          "url": "https://www.suse.com/security/cve/CVE-2024-44905"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-44905"
    },
    {
      "cve": "CVE-2024-44906",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-44906"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-44906",
          "url": "https://www.suse.com/security/cve/CVE-2024-44906"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-44906"
    },
    {
      "cve": "CVE-2024-56731",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-56731"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it\u0027s still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users\u0027 code hosted on the same instance. This issue has been patched in version 0.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-56731",
          "url": "https://www.suse.com/security/cve/CVE-2024-56731"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2024-56731"
    },
    {
      "cve": "CVE-2025-0928",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-0928"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-0928",
          "url": "https://www.suse.com/security/cve/CVE-2025-0928"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-0928"
    },
    {
      "cve": "CVE-2025-1088",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-1088"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana.\nThis issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-1088",
          "url": "https://www.suse.com/security/cve/CVE-2025-1088"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245224 for CVE-2025-1088",
          "url": "https://bugzilla.suse.com/1245224"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-1088"
    },
    {
      "cve": "CVE-2025-30086",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-30086"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users\u0027 password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user\u0027s password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-30086",
          "url": "https://www.suse.com/security/cve/CVE-2025-30086"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-30086"
    },
    {
      "cve": "CVE-2025-32019",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-32019"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-32019",
          "url": "https://www.suse.com/security/cve/CVE-2025-32019"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-32019"
    },
    {
      "cve": "CVE-2025-3227",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3227"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.5, 9.11.x \u003c= 9.11.15, 10.8.x \u003c= 10.8.0, 10.7.x \u003c= 10.7.2, 10.6.x \u003c= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the \u0027Manage Channel Members\u0027 permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3227",
          "url": "https://www.suse.com/security/cve/CVE-2025-3227"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3227"
    },
    {
      "cve": "CVE-2025-3228",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3228"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.5, 9.11.x \u003c= 9.11.15, 10.8.x \u003c= 10.8.0, 10.7.x \u003c= 10.7.2, 10.6.x \u003c= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3228",
          "url": "https://www.suse.com/security/cve/CVE-2025-3228"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3228"
    },
    {
      "cve": "CVE-2025-3415",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3415"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3415",
          "url": "https://www.suse.com/security/cve/CVE-2025-3415"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245302 for CVE-2025-3415",
          "url": "https://bugzilla.suse.com/1245302"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-3415"
    },
    {
      "cve": "CVE-2025-4563",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4563"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4563",
          "url": "https://www.suse.com/security/cve/CVE-2025-4563"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245185 for CVE-2025-4563",
          "url": "https://bugzilla.suse.com/1245185"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-4563"
    },
    {
      "cve": "CVE-2025-4656",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4656"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4656",
          "url": "https://www.suse.com/security/cve/CVE-2025-4656"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-4656"
    },
    {
      "cve": "CVE-2025-46702",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46702"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.5, 9.11.x \u003c= 9.11.15, 10.8.x \u003c= 10.8.0, 10.7.x \u003c= 10.7.2, 10.6.x \u003c= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions and add or remove users to/from private channels via the playbook run participants feature, even when the \u0027Manage Members\u0027 permission has been explicitly removed. This can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46702",
          "url": "https://www.suse.com/security/cve/CVE-2025-46702"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-46702"
    },
    {
      "cve": "CVE-2025-4674",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4674"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \"go get\", are not affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4674",
          "url": "https://www.suse.com/security/cve/CVE-2025-4674"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246118 for CVE-2025-4674",
          "url": "https://bugzilla.suse.com/1246118"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-4674"
    },
    {
      "cve": "CVE-2025-47281",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47281"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47281",
          "url": "https://www.suse.com/security/cve/CVE-2025-47281"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-47281"
    },
    {
      "cve": "CVE-2025-47871",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47871"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.5, 9.11.x \u003c= 9.11.15, 10.8.x \u003c= 10.8.0, 10.7.x \u003c= 10.7.2, 10.6.x \u003c= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47871",
          "url": "https://www.suse.com/security/cve/CVE-2025-47871"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47871"
    },
    {
      "cve": "CVE-2025-47943",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47943"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47943",
          "url": "https://www.suse.com/security/cve/CVE-2025-47943"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47943"
    },
    {
      "cve": "CVE-2025-4922",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4922"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Nomad Community and Nomad Enterprise (\"Nomad\") prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4922",
          "url": "https://www.suse.com/security/cve/CVE-2025-4922"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-4922"
    },
    {
      "cve": "CVE-2025-4981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-4981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.5, 9.11.x \u003c= 9.11.15, 10.8.x \u003c= 10.8.0, 10.7.x \u003c= 10.7.2, 10.6.x \u003c= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-4981",
          "url": "https://www.suse.com/security/cve/CVE-2025-4981"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2025-4981"
    },
    {
      "cve": "CVE-2025-49825",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-49825"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-49825",
          "url": "https://www.suse.com/security/cve/CVE-2025-49825"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244718 for CVE-2025-49825",
          "url": "https://bugzilla.suse.com/1244718"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2025-49825"
    },
    {
      "cve": "CVE-2025-5030",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-5030"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-5030",
          "url": "https://www.suse.com/security/cve/CVE-2025-5030"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-5030"
    },
    {
      "cve": "CVE-2025-51471",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-51471"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-51471",
          "url": "https://www.suse.com/security/cve/CVE-2025-51471"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246915 for CVE-2025-51471",
          "url": "https://bugzilla.suse.com/1246915"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-51471"
    },
    {
      "cve": "CVE-2025-52477",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52477"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52477",
          "url": "https://www.suse.com/security/cve/CVE-2025-52477"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52477"
    },
    {
      "cve": "CVE-2025-52889",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52889"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52889",
          "url": "https://www.suse.com/security/cve/CVE-2025-52889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245365 for CVE-2025-52889",
          "url": "https://bugzilla.suse.com/1245365"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-52889"
    },
    {
      "cve": "CVE-2025-52890",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52890"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52890",
          "url": "https://www.suse.com/security/cve/CVE-2025-52890"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245367 for CVE-2025-52890",
          "url": "https://bugzilla.suse.com/1245367"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52890"
    },
    {
      "cve": "CVE-2025-52893",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52893"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52893",
          "url": "https://www.suse.com/security/cve/CVE-2025-52893"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245381 for CVE-2025-52893",
          "url": "https://bugzilla.suse.com/1245381"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-52893"
    },
    {
      "cve": "CVE-2025-52894",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52894"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao\u0027s website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52894",
          "url": "https://www.suse.com/security/cve/CVE-2025-52894"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245389 for CVE-2025-52894",
          "url": "https://bugzilla.suse.com/1245389"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52894"
    },
    {
      "cve": "CVE-2025-52900",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52900"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52900",
          "url": "https://www.suse.com/security/cve/CVE-2025-52900"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-52900"
    },
    {
      "cve": "CVE-2025-52901",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52901"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user\u0027s account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52901",
          "url": "https://www.suse.com/security/cve/CVE-2025-52901"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-52901"
    },
    {
      "cve": "CVE-2025-52902",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52902"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52902",
          "url": "https://www.suse.com/security/cve/CVE-2025-52902"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52902"
    },
    {
      "cve": "CVE-2025-52903",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52903"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application\u0027s configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. The fix is tracked on pull request 5199.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52903",
          "url": "https://www.suse.com/security/cve/CVE-2025-52903"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52903"
    },
    {
      "cve": "CVE-2025-52904",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52904"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application\u0027s configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52904",
          "url": "https://www.suse.com/security/cve/CVE-2025-52904"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52904"
    },
    {
      "cve": "CVE-2025-52995",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52995"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52995",
          "url": "https://www.suse.com/security/cve/CVE-2025-52995"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52995"
    },
    {
      "cve": "CVE-2025-52996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52996",
          "url": "https://www.suse.com/security/cve/CVE-2025-52996"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-52996"
    },
    {
      "cve": "CVE-2025-52997",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-52997"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-52997",
          "url": "https://www.suse.com/security/cve/CVE-2025-52997"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-52997"
    },
    {
      "cve": "CVE-2025-53512",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53512"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53512",
          "url": "https://www.suse.com/security/cve/CVE-2025-53512"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-53512"
    },
    {
      "cve": "CVE-2025-53513",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53513"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53513",
          "url": "https://www.suse.com/security/cve/CVE-2025-53513"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53513"
    },
    {
      "cve": "CVE-2025-53547",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53547"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53547",
          "url": "https://www.suse.com/security/cve/CVE-2025-53547"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246150 for CVE-2025-53547",
          "url": "https://bugzilla.suse.com/1246150"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53547"
    },
    {
      "cve": "CVE-2025-53632",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53632"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53632",
          "url": "https://www.suse.com/security/cve/CVE-2025-53632"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53632"
    },
    {
      "cve": "CVE-2025-53633",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53633"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 14042aa and shipped in v0.1.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53633",
          "url": "https://www.suse.com/security/cve/CVE-2025-53633"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53633"
    },
    {
      "cve": "CVE-2025-53634",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53634"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 1385bd8 and shipped in v0.1.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53634",
          "url": "https://www.suse.com/security/cve/CVE-2025-53634"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53634"
    },
    {
      "cve": "CVE-2025-53826",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53826"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser\u0027s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53826",
          "url": "https://www.suse.com/security/cve/CVE-2025-53826"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53826"
    },
    {
      "cve": "CVE-2025-53893",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53893"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint  `Filebrowser-Server-IP:PORT/files/{file-name}` . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations without size checks or resource limits. This allows an authenticated user to upload a large file and trigger uncontrolled memory consumption on read, potentially crashing the server and making it unresponsive. As of time of publication, no known patches are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53893",
          "url": "https://www.suse.com/security/cve/CVE-2025-53893"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53893"
    },
    {
      "cve": "CVE-2025-53945",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53945"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53945",
          "url": "https://www.suse.com/security/cve/CVE-2025-53945"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246746 for CVE-2025-53945",
          "url": "https://bugzilla.suse.com/1246746"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53945"
    },
    {
      "cve": "CVE-2025-54059",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54059"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54059",
          "url": "https://www.suse.com/security/cve/CVE-2025-54059"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246745 for CVE-2025-54059",
          "url": "https://bugzilla.suse.com/1246745"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-54059"
    },
    {
      "cve": "CVE-2025-54379",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-54379"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-54379",
          "url": "https://www.suse.com/security/cve/CVE-2025-54379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "not set"
        }
      ],
      "title": "CVE-2025-54379"
    },
    {
      "cve": "CVE-2025-5689",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-5689"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-5689",
          "url": "https://www.suse.com/security/cve/CVE-2025-5689"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-5689"
    },
    {
      "cve": "CVE-2025-5981",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-5981"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR\u0027s unpack()  function for container images. Particularly, when using the CLI flag --remote-image  on untrusted container images.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-5981",
          "url": "https://www.suse.com/security/cve/CVE-2025-5981"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244726 for CVE-2025-5981",
          "url": "https://bugzilla.suse.com/1244726"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-5981"
    },
    {
      "cve": "CVE-2025-6023",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6023"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6023",
          "url": "https://www.suse.com/security/cve/CVE-2025-6023"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246735 for CVE-2025-6023",
          "url": "https://bugzilla.suse.com/1246735"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-6023"
    },
    {
      "cve": "CVE-2025-6032",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6032"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6032",
          "url": "https://www.suse.com/security/cve/CVE-2025-6032"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245320 for CVE-2025-6032",
          "url": "https://bugzilla.suse.com/1245320"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-6032"
    },
    {
      "cve": "CVE-2025-6224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6224",
          "url": "https://www.suse.com/security/cve/CVE-2025-6224"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-6224"
    },
    {
      "cve": "CVE-2025-6226",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6226"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.6, 10.8.x \u003c= 10.8.1, 10.7.x \u003c= 10.7.3, 9.11.x \u003c= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don\u0027t have access to via guessing the PendingPostID of recently created posts.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6226",
          "url": "https://www.suse.com/security/cve/CVE-2025-6226"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-6226"
    },
    {
      "cve": "CVE-2025-6227",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6227"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.5.x \u003c= 10.5.7, 9.11.x \u003c= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6227",
          "url": "https://www.suse.com/security/cve/CVE-2025-6227"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-6227"
    },
    {
      "cve": "CVE-2025-6233",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6233"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mattermost versions 10.8.x \u003c= 10.8.1, 10.7.x \u003c= 10.7.3, 10.5.x \u003c= 10.5.7, 9.11.x \u003c= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6233",
          "url": "https://www.suse.com/security/cve/CVE-2025-6233"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-6233"
    },
    {
      "cve": "CVE-2025-6264",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6264"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.   To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.\n\nThe Admin.Client.UpdateClientConfig is an artifact used to update the client\u0027s configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and update the configuration. \n\nThis can lead to arbitrary command execution and endpoint takeover.\n\nTo successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator\u0027 role).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6264",
          "url": "https://www.suse.com/security/cve/CVE-2025-6264"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245123 for CVE-2025-6264",
          "url": "https://bugzilla.suse.com/1245123"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-6264"
    },
    {
      "cve": "CVE-2025-6624",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6624"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode.\r\rThe issue affects the following Snyk commands:\r\r1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and  --username/-u).\r\r2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs.\r\r3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6624",
          "url": "https://www.suse.com/security/cve/CVE-2025-6624"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-08-04T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-6624"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-52997 (GCVE-0-2025-52997)

FKIE_CVE-2025-52997

GHSA-CM2R-RG7R-P7GG

Summary

Impact

Vulnerability Description

Proof of Concept

Recommended Countermeasures

Timeline

References

Credits

CNVD-2025-22705

OPENSUSE-SU-2025:15405-1

Tags

Sightings

Nomenclature