Tumbleweed vulnerabilities

5 known vulnerabilities in Tumbleweed from openSUSE. 5 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  Tumbleweed: UNIX Symbolic Link (Symlink) Following

  CVE-2025-46810Sep 2, 2025openSUSE

  A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29.

• 7.3 High severity

  Insecure creation of temporary files allows local users on systems with non-default…

  CVE-2024-49506Nov 13, 2024openSUSE

  Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem

• 7.8 High severity

  Tumbleweed: Incorrect Default Permissions

  CVE-2023-32183Jul 7, 2023openSUSE

  Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE Tumbleweed.

• 7.8 High severity

  Tumbleweed: Improper Link Resolution Before File Access

  CVE-2022-31250Jul 20, 2022openSUSE

  A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.

• 10.0 High severity

  ProFTPD Improper Access Control Exploited

  CVE-2015-3306May 18, 2015Fedora ProjectEPSS 99.5%

  The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.