{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/golang/glog",
          "product": "github.com/golang/glog",
          "programRoutines": [
            {
              "name": "create"
            },
            {
              "name": "Error"
            },
            {
              "name": "ErrorContext"
            },
            {
              "name": "ErrorContextDepth"
            },
            {
              "name": "ErrorContextDepthf"
            },
            {
              "name": "ErrorContextf"
            },
            {
              "name": "ErrorDepth"
            },
            {
              "name": "ErrorDepthf"
            },
            {
              "name": "Errorf"
            },
            {
              "name": "Errorln"
            },
            {
              "name": "Exit"
            },
            {
              "name": "ExitContext"
            },
            {
              "name": "ExitContextDepth"
            },
            {
              "name": "ExitContextDepthf"
            },
            {
              "name": "ExitContextf"
            },
            {
              "name": "ExitDepth"
            },
            {
              "name": "ExitDepthf"
            },
            {
              "name": "Exitf"
            },
            {
              "name": "Exitln"
            },
            {
              "name": "Fatal"
            },
            {
              "name": "FatalContext"
            },
            {
              "name": "FatalContextDepth"
            },
            {
              "name": "FatalContextDepthf"
            },
            {
              "name": "FatalContextf"
            },
            {
              "name": "FatalDepth"
            },
            {
              "name": "FatalDepthf"
            },
            {
              "name": "Fatalf"
            },
            {
              "name": "Fatalln"
            },
            {
              "name": "Info"
            },
            {
              "name": "InfoContext"
            },
            {
              "name": "InfoContextDepth"
            },
            {
              "name": "InfoContextDepthf"
            },
            {
              "name": "InfoContextf"
            },
            {
              "name": "InfoDepth"
            },
            {
              "name": "InfoDepthf"
            },
            {
              "name": "Infof"
            },
            {
              "name": "Infoln"
            },
            {
              "name": "Verbose.Info"
            },
            {
              "name": "Verbose.InfoContext"
            },
            {
              "name": "Verbose.InfoContextDepth"
            },
            {
              "name": "Verbose.InfoContextDepthf"
            },
            {
              "name": "Verbose.InfoContextf"
            },
            {
              "name": "Verbose.InfoDepth"
            },
            {
              "name": "Verbose.InfoDepthf"
            },
            {
              "name": "Verbose.Infof"
            },
            {
              "name": "Verbose.Infoln"
            },
            {
              "name": "Warning"
            },
            {
              "name": "WarningContext"
            },
            {
              "name": "WarningContextDepth"
            },
            {
              "name": "WarningContextDepthf"
            },
            {
              "name": "WarningContextf"
            },
            {
              "name": "WarningDepth"
            },
            {
              "name": "WarningDepthf"
            },
            {
              "name": "Warningf"
            },
            {
              "name": "Warningln"
            },
            {
              "name": "fileSink.Emit"
            },
            {
              "name": "logBridge.Write"
            },
            {
              "name": "syncBuffer.Write"
            }
          ],
          "vendor": "github.com/golang/glog",
          "versions": [
            {
              "lessThan": "1.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@golang.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists."
    },
    {
      "lang": "es",
      "value": "Cuando los registros se escriben en un directorio de amplia escritura (el predeterminado), un atacante sin privilegios puede predecir la ruta del archivo de registro de un proceso privilegiado y crear previamente un enlace simb\u00f3lico a un archivo confidencial en su lugar. Cuando se ejecuta ese proceso privilegiado, seguir\u00e1 el enlace simb\u00f3lico plantado y sobrescribir\u00e1 ese archivo confidencial. Para solucionarlo, glog ahora hace que el programa salga (con el c\u00f3digo de estado 2) cuando descubre que el archivo de registro configurado ya existe."
    }
  ],
  "id": "CVE-2024-45339",
  "lastModified": "2026-06-17T07:54:03.643",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45339",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-29T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-01-28T02:15:28.927",
  "references": [
    {
      "source": "security@golang.org",
      "url": "https://github.com/golang/glog/pull/74"
    },
    {
      "source": "security@golang.org",
      "url": "https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2"
    },
    {
      "source": "security@golang.org",
      "url": "https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs"
    },
    {
      "source": "security@golang.org",
      "url": "https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File"
    },
    {
      "source": "security@golang.org",
      "url": "https://pkg.go.dev/vuln/GO-2025-3372"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html"
    }
  ],
  "sourceIdentifier": "security@golang.org",
  "vulnStatus": "Deferred"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/golang/glog"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-377",
      "CWE-61"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-28T17:29:03Z",
    "nvd_published_at": "2025-01-28T02:15:28Z",
    "severity": "MODERATE"
  },
  "details": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
  "id": "GHSA-6wxm-mpqj-6jpf",
  "modified": "2025-02-18T22:36:58Z",
  "published": "2025-01-28T17:29:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45339"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/glog/pull/74"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/golang/glog"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3372"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Insecure Temporary File usage in github.com/golang/glog"
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-45339 Vulnerability when creating log files in github.com/golang/glog - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-45339.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Vulnerability when creating log files in github.com/golang/glog",
    "tracking": {
      "current_release_date": "2026-02-18T02:48:57.000Z",
      "generator": {
        "date": "2026-02-18T09:44:32.800Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-45339",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-02-11T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2025-02-13T00:00:00.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2025-02-21T00:00:00.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2026-02-18T02:48:57.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              },
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 vitess 17.0.7-4",
                "product": {
                  "name": "\u003ccbl2 vitess 17.0.7-4",
                  "product_id": "15"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 vitess 17.0.7-4",
                "product": {
                  "name": "cbl2 vitess 17.0.7-4",
                  "product_id": "17113"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 vitess 19.0.4-4",
                "product": {
                  "name": "\u003cazl3 vitess 19.0.4-4",
                  "product_id": "11"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 vitess 19.0.4-4",
                "product": {
                  "name": "azl3 vitess 19.0.4-4",
                  "product_id": "17484"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 vitess 17.0.7-8",
                "product": {
                  "name": "\u003ccbl2 vitess 17.0.7-8",
                  "product_id": "4"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 vitess 17.0.7-8",
                "product": {
                  "name": "cbl2 vitess 17.0.7-8",
                  "product_id": "19698"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 vitess 19.0.4-7",
                "product": {
                  "name": "\u003cazl3 vitess 19.0.4-7",
                  "product_id": "10"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 vitess 19.0.4-7",
                "product": {
                  "name": "azl3 vitess 19.0.4-7",
                  "product_id": "17547"
                }
              }
            ],
            "category": "product_name",
            "name": "vitess"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-8",
                "product": {
                  "name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-8",
                  "product_id": "14"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 sriov-network-device-plugin 3.6.2-8",
                "product": {
                  "name": "cbl2 sriov-network-device-plugin 3.6.2-8",
                  "product_id": "17114"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 sriov-network-device-plugin 3.7.0-3",
                "product": {
                  "name": "\u003cazl3 sriov-network-device-plugin 3.7.0-3",
                  "product_id": "12"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 sriov-network-device-plugin 3.7.0-3",
                "product": {
                  "name": "azl3 sriov-network-device-plugin 3.7.0-3",
                  "product_id": "17483"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 sriov-network-device-plugin 3.7.0-4",
                "product": {
                  "name": "\u003cazl3 sriov-network-device-plugin 3.7.0-4",
                  "product_id": "7"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 sriov-network-device-plugin 3.7.0-4",
                "product": {
                  "name": "azl3 sriov-network-device-plugin 3.7.0-4",
                  "product_id": "19341"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-9",
                "product": {
                  "name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-9",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 sriov-network-device-plugin 3.6.2-9",
                "product": {
                  "name": "cbl2 sriov-network-device-plugin 3.6.2-9",
                  "product_id": "19680"
                }
              }
            ],
            "category": "product_name",
            "name": "sriov-network-device-plugin"
          },
          {
            "category": "product_name",
            "name": "cbl2 prometheus 2.37.9-4",
            "product": {
              "name": "cbl2 prometheus 2.37.9-4",
              "product_id": "2"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 prometheus 2.45.4-12",
            "product": {
              "name": "azl3 prometheus 2.45.4-12",
              "product_id": "8"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 glog 0.3.5-16",
            "product": {
              "name": "cbl2 glog 0.3.5-16",
              "product_id": "1"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 application-gateway-kubernetes-ingress 1.4.0-25",
            "product": {
              "name": "cbl2 application-gateway-kubernetes-ingress 1.4.0-25",
              "product_id": "13"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 jx 3.2.236-21",
            "product": {
              "name": "cbl2 jx 3.2.236-21",
              "product_id": "5"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 application-gateway-kubernetes-ingress 1.4.0-25",
            "product": {
              "name": "cbl2 application-gateway-kubernetes-ingress 1.4.0-25",
              "product_id": "3"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 jx 3.10.182-1",
            "product": {
              "name": "azl3 jx 3.10.182-1",
              "product_id": "9"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 vitess 17.0.7-4 as a component of CBL Mariner 2.0",
          "product_id": "17086-15"
        },
        "product_reference": "15",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 vitess 17.0.7-4 as a component of CBL Mariner 2.0",
          "product_id": "17113-17086"
        },
        "product_reference": "17113",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-8 as a component of CBL Mariner 2.0",
          "product_id": "17086-14"
        },
        "product_reference": "14",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 sriov-network-device-plugin 3.6.2-8 as a component of CBL Mariner 2.0",
          "product_id": "17114-17086"
        },
        "product_reference": "17114",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 sriov-network-device-plugin 3.7.0-3 as a component of Azure Linux 3.0",
          "product_id": "17084-12"
        },
        "product_reference": "12",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 sriov-network-device-plugin 3.7.0-3 as a component of Azure Linux 3.0",
          "product_id": "17483-17084"
        },
        "product_reference": "17483",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 vitess 19.0.4-4 as a component of Azure Linux 3.0",
          "product_id": "17084-11"
        },
        "product_reference": "11",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 vitess 19.0.4-4 as a component of Azure Linux 3.0",
          "product_id": "17484-17084"
        },
        "product_reference": "17484",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 vitess 17.0.7-8 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 vitess 17.0.7-8 as a component of CBL Mariner 2.0",
          "product_id": "19698-17086"
        },
        "product_reference": "19698",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 sriov-network-device-plugin 3.7.0-4 as a component of Azure Linux 3.0",
          "product_id": "17084-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 sriov-network-device-plugin 3.7.0-4 as a component of Azure Linux 3.0",
          "product_id": "19341-17084"
        },
        "product_reference": "19341",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 prometheus 2.37.9-4 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 prometheus 2.45.4-12 as a component of Azure Linux 3.0",
          "product_id": "17084-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 glog 0.3.5-16 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 application-gateway-kubernetes-ingress 1.4.0-25 as a component of CBL Mariner 2.0",
          "product_id": "17086-13"
        },
        "product_reference": "13",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 vitess 19.0.4-7 as a component of Azure Linux 3.0",
          "product_id": "17084-10"
        },
        "product_reference": "10",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 vitess 19.0.4-7 as a component of Azure Linux 3.0",
          "product_id": "17547-17084"
        },
        "product_reference": "17547",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 sriov-network-device-plugin 3.6.2-9 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 sriov-network-device-plugin 3.6.2-9 as a component of CBL Mariner 2.0",
          "product_id": "19680-17086"
        },
        "product_reference": "19680",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 jx 3.2.236-21 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 application-gateway-kubernetes-ingress 1.4.0-25 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 jx 3.10.182-1 as a component of Azure Linux 3.0",
          "product_id": "17084-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45339",
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17086-2",
            "17084-8",
            "17086-1",
            "17086-13",
            "17086-5",
            "17086-3",
            "17084-9"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17113-17086",
          "17114-17086",
          "17483-17084",
          "17484-17084",
          "19698-17086",
          "19341-17084",
          "17547-17084",
          "19680-17086"
        ],
        "known_affected": [
          "17086-15",
          "17086-14",
          "17084-12",
          "17084-11",
          "17086-4",
          "17084-7",
          "17084-10",
          "17086-6"
        ],
        "known_not_affected": [
          "17086-2",
          "17084-8",
          "17086-1",
          "17086-13",
          "17086-5",
          "17086-3",
          "17084-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-45339 Vulnerability when creating log files in github.com/golang/glog - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-45339.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-11T00:00:00.000Z",
          "details": "17.0.7-4:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-15",
            "17086-4"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-02-11T00:00:00.000Z",
          "details": "3.6.2-8:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-14",
            "17086-6"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-02-11T00:00:00.000Z",
          "details": "3.7.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-12",
            "17084-7"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2025-02-11T00:00:00.000Z",
          "details": "19.0.4-4:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-11",
            "17084-10"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.1,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "17086-15",
            "17086-14",
            "17084-12",
            "17084-11",
            "17086-4",
            "17084-7",
            "17084-10",
            "17086-6"
          ]
        }
      ],
      "title": "Vulnerability when creating log files in github.com/golang/glog"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-14710",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14710-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-11218 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-11218/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45336 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45340 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45340/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45341 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45341/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-0377 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-0377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22865 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22865/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23028 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23028/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23047 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23047/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-23208 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-23208/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-24030 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-24030/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-24337 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-24337/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-24354 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-24354/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-24355 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-24355/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-01-29T00:00:00Z",
      "generator": {
        "date": "2025-01-29T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:14710-1",
      "initial_release_date": "2025-01-29T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-01-29T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20250128T150132-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-11218",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-11218"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-11218",
          "url": "https://www.suse.com/security/cve/CVE-2024-11218"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236269 for CVE-2024-11218",
          "url": "https://bugzilla.suse.com/1236269"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-11218"
    },
    {
      "cve": "CVE-2024-45336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45336",
          "url": "https://www.suse.com/security/cve/CVE-2024-45336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236045 for CVE-2024-45336",
          "url": "https://bugzilla.suse.com/1236045"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236046 for CVE-2024-45336",
          "url": "https://bugzilla.suse.com/1236046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45336"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    },
    {
      "cve": "CVE-2024-45340",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45340"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45340",
          "url": "https://www.suse.com/security/cve/CVE-2024-45340"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236360 for CVE-2024-45340",
          "url": "https://bugzilla.suse.com/1236360"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45340"
    },
    {
      "cve": "CVE-2024-45341",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45341"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45341",
          "url": "https://www.suse.com/security/cve/CVE-2024-45341"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236045 for CVE-2024-45341",
          "url": "https://bugzilla.suse.com/1236045"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45341"
    },
    {
      "cve": "CVE-2025-0377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-0377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "HashiCorp\u0027s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-0377",
          "url": "https://www.suse.com/security/cve/CVE-2025-0377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236209 for CVE-2025-0377",
          "url": "https://bugzilla.suse.com/1236209"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2025-0377"
    },
    {
      "cve": "CVE-2025-22865",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22865"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22865",
          "url": "https://www.suse.com/security/cve/CVE-2025-22865"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236361 for CVE-2025-22865",
          "url": "https://bugzilla.suse.com/1236361"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22865"
    },
    {
      "cve": "CVE-2025-23028",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23028"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23028",
          "url": "https://www.suse.com/security/cve/CVE-2025-23028"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-23028"
    },
    {
      "cve": "CVE-2025-23047",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23047"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23047",
          "url": "https://www.suse.com/security/cve/CVE-2025-23047"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-23047"
    },
    {
      "cve": "CVE-2025-23208",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-23208"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn\u0027t obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-23208",
          "url": "https://www.suse.com/security/cve/CVE-2025-23208"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-23208"
    },
    {
      "cve": "CVE-2025-24030",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-24030"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-24030",
          "url": "https://www.suse.com/security/cve/CVE-2025-24030"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-24030"
    },
    {
      "cve": "CVE-2025-24337",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-24337"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-24337",
          "url": "https://www.suse.com/security/cve/CVE-2025-24337"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-24337"
    },
    {
      "cve": "CVE-2025-24354",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-24354"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-24354",
          "url": "https://www.suse.com/security/cve/CVE-2025-24354"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-24354"
    },
    {
      "cve": "CVE-2025-24355",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-24355"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-24355",
          "url": "https://www.suse.com/security/cve/CVE-2025-24355"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236404 for CVE-2025-24355",
          "url": "https://bugzilla.suse.com/1236404"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250128T150132-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-01-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-24355"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "google-osconfig-agent-20250115.01-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the google-osconfig-agent-20250115.01-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-14815",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14815-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2025:14815-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GLG6TDNP2NZPYXB6GPK2TQLL6BGQNAKY/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2025:14815-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GLG6TDNP2NZPYXB6GPK2TQLL6BGQNAKY/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      }
    ],
    "title": "google-osconfig-agent-20250115.01-2.1 on GA media",
    "tracking": {
      "current_release_date": "2025-02-18T00:00:00Z",
      "generator": {
        "date": "2025-02-18T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:14815-1",
      "initial_release_date": "2025-02-18T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-02-18T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20250115.01-2.1.aarch64",
                "product": {
                  "name": "google-osconfig-agent-20250115.01-2.1.aarch64",
                  "product_id": "google-osconfig-agent-20250115.01-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20250115.01-2.1.ppc64le",
                "product": {
                  "name": "google-osconfig-agent-20250115.01-2.1.ppc64le",
                  "product_id": "google-osconfig-agent-20250115.01-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20250115.01-2.1.s390x",
                "product": {
                  "name": "google-osconfig-agent-20250115.01-2.1.s390x",
                  "product_id": "google-osconfig-agent-20250115.01-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "google-osconfig-agent-20250115.01-2.1.x86_64",
                "product": {
                  "name": "google-osconfig-agent-20250115.01-2.1.x86_64",
                  "product_id": "google-osconfig-agent-20250115.01-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20250115.01-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.aarch64"
        },
        "product_reference": "google-osconfig-agent-20250115.01-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20250115.01-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.ppc64le"
        },
        "product_reference": "google-osconfig-agent-20250115.01-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20250115.01-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.s390x"
        },
        "product_reference": "google-osconfig-agent-20250115.01-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "google-osconfig-agent-20250115.01-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.x86_64"
        },
        "product_reference": "google-osconfig-agent-20250115.01-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.aarch64",
          "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.ppc64le",
          "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.s390x",
          "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.aarch64",
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.ppc64le",
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.s390x",
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.aarch64",
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.ppc64le",
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.s390x",
            "openSUSE Tumbleweed:google-osconfig-agent-20250115.01-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-18T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "etcd-for-k8s1.32-3.5.24-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the etcd-for-k8s1.32-3.5.24-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-15764",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15764-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20329 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20329/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      }
    ],
    "title": "etcd-for-k8s1.32-3.5.24-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-11-25T00:00:00Z",
      "generator": {
        "date": "2025-11-25T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:15764-1",
      "initial_release_date": "2025-11-25T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-11-25T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.aarch64",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.aarch64",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.s390x",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.s390x",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "etcd-for-k8s1.32-3.5.24-1.1.x86_64",
                "product": {
                  "name": "etcd-for-k8s1.32-3.5.24-1.1.x86_64",
                  "product_id": "etcd-for-k8s1.32-3.5.24-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "etcd-for-k8s1.32-3.5.24-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
        },
        "product_reference": "etcd-for-k8s1.32-3.5.24-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20329",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20329"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20329",
          "url": "https://www.suse.com/security/cve/CVE-2021-20329"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-20329"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
          "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.aarch64",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.ppc64le",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.s390x",
            "openSUSE Tumbleweed:etcd-for-k8s1.32-3.5.24-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11126",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11126-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45288 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45339 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45339/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-13465 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-13465/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22868 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22868/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22869 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22870 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-24358 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-24358/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58058 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58058/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-5889 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-5889/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-64718 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-64718/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6545 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6545/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-6547 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-6547/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-7783 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-7783/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1229 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1229/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25128 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25128/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25680 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25680/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25681 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25681/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26278 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26278/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26996 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26996/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27136 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27136/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-2739 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-2739/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27606 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27606/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27904 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27904/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33036 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33036/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33487 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33487/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33814 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39821 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39821/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39827 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39827/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39828 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39828/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39829 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39829/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39830 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39830/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39831 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39831/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39832 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39832/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39833 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39833/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39834 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39834/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39835 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39835/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42039 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42039/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42502 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42502/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42506 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42506/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42508 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42508/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46595 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46595/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46597 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46597/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-46598 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-46598/"
      }
    ],
    "title": "velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-06-25T00:00:00Z",
      "generator": {
        "date": "2026-06-25T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11126-1",
      "initial_release_date": "2026-06-25T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-25T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
                "product": {
                  "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
                  "product_id": "velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
                "product": {
                  "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
                  "product_id": "velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
                "product": {
                  "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
                  "product_id": "velociraptor-0.7.0.4.git185.a5708584-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64",
                "product": {
                  "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64",
                  "product_id": "velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64"
        },
        "product_reference": "velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le"
        },
        "product_reference": "velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x"
        },
        "product_reference": "velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        },
        "product_reference": "velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45288",
          "url": "https://www.suse.com/security/cve/CVE-2023-45288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221400 for CVE-2023-45288",
          "url": "https://bugzilla.suse.com/1221400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-45288"
    },
    {
      "cve": "CVE-2024-45339",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45339"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45339",
          "url": "https://www.suse.com/security/cve/CVE-2024-45339"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1236541 for CVE-2024-45339",
          "url": "https://bugzilla.suse.com/1236541"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45339"
    },
    {
      "cve": "CVE-2025-13465",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-13465"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset  and _.omit  functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-13465",
          "url": "https://www.suse.com/security/cve/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257321 for CVE-2025-13465",
          "url": "https://bugzilla.suse.com/1257321"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-13465"
    },
    {
      "cve": "CVE-2025-22868",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22868"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22868",
          "url": "https://www.suse.com/security/cve/CVE-2025-22868"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239185 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239185"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239186 for CVE-2025-22868",
          "url": "https://bugzilla.suse.com/1239186"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22868"
    },
    {
      "cve": "CVE-2025-22869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22869",
          "url": "https://www.suse.com/security/cve/CVE-2025-22869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239322 for CVE-2025-22869",
          "url": "https://bugzilla.suse.com/1239322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22869"
    },
    {
      "cve": "CVE-2025-22870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22870",
          "url": "https://www.suse.com/security/cve/CVE-2025-22870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238572 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238611 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22870"
    },
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265255 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1265255"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265256 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1265256"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265259 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1265259"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-24358",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-24358"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications \u0026 services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for \"server\" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-24358",
          "url": "https://www.suse.com/security/cve/CVE-2025-24358"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241233 for CVE-2025-24358",
          "url": "https://bugzilla.suse.com/1241233"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-24358"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58058",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58058"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58058",
          "url": "https://www.suse.com/security/cve/CVE-2025-58058"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248889 for CVE-2025-58058",
          "url": "https://bugzilla.suse.com/1248889"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58058"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    },
    {
      "cve": "CVE-2025-5889",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-5889"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-5889",
          "url": "https://www.suse.com/security/cve/CVE-2025-5889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1244340 for CVE-2025-5889",
          "url": "https://bugzilla.suse.com/1244340"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-5889"
    },
    {
      "cve": "CVE-2025-64718",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-64718"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it\u0027s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-64718",
          "url": "https://www.suse.com/security/cve/CVE-2025-64718"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1255407 for CVE-2025-64718",
          "url": "https://bugzilla.suse.com/1255407"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-64718"
    },
    {
      "cve": "CVE-2025-6545",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6545"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js.\n\nThis issue affects pbkdf2: from 3.0.10 through 3.1.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6545",
          "url": "https://www.suse.com/security/cve/CVE-2025-6545"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245273 for CVE-2025-6545",
          "url": "https://bugzilla.suse.com/1245273"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-6545"
    },
    {
      "cve": "CVE-2025-6547",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-6547"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: \u003c=3.1.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-6547",
          "url": "https://www.suse.com/security/cve/CVE-2025-6547"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1245271 for CVE-2025-6547",
          "url": "https://bugzilla.suse.com/1245271"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-6547"
    },
    {
      "cve": "CVE-2025-7783",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-7783"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-7783",
          "url": "https://www.suse.com/security/cve/CVE-2025-7783"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246810 for CVE-2025-7783",
          "url": "https://bugzilla.suse.com/1246810"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-7783"
    },
    {
      "cve": "CVE-2026-1229",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1229"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in  v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1229",
          "url": "https://www.suse.com/security/cve/CVE-2026-1229"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265416 for CVE-2026-1229",
          "url": "https://bugzilla.suse.com/1265416"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-1229"
    },
    {
      "cve": "CVE-2026-25128",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25128"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `\u0026#9999999;` or `\u0026#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25128",
          "url": "https://www.suse.com/security/cve/CVE-2026-25128"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257518 for CVE-2026-25128",
          "url": "https://bugzilla.suse.com/1257518"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25128"
    },
    {
      "cve": "CVE-2026-25680",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25680"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25680",
          "url": "https://www.suse.com/security/cve/CVE-2026-25680"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-25680",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25680"
    },
    {
      "cve": "CVE-2026-25681",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25681"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25681",
          "url": "https://www.suse.com/security/cve/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-25681",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25681"
    },
    {
      "cve": "CVE-2026-26278",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26278"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it\u0027s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26278",
          "url": "https://www.suse.com/security/cve/CVE-2026-26278"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258547 for CVE-2026-26278",
          "url": "https://bugzilla.suse.com/1258547"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-26278"
    },
    {
      "cve": "CVE-2026-26996",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26996"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn\u0027t appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8\u0027s regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26996",
          "url": "https://www.suse.com/security/cve/CVE-2026-26996"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258621 for CVE-2026-26996",
          "url": "https://bugzilla.suse.com/1258621"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-26996"
    },
    {
      "cve": "CVE-2026-27136",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27136"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27136",
          "url": "https://www.suse.com/security/cve/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-27136",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27136"
    },
    {
      "cve": "CVE-2026-2739",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-2739"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-2739",
          "url": "https://www.suse.com/security/cve/CVE-2026-2739"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258647 for CVE-2026-2739",
          "url": "https://bugzilla.suse.com/1258647"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-2739"
    },
    {
      "cve": "CVE-2026-27606",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27606"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27606",
          "url": "https://www.suse.com/security/cve/CVE-2026-27606"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258846 for CVE-2026-27606",
          "url": "https://bugzilla.suse.com/1258846"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27606"
    },
    {
      "cve": "CVE-2026-27904",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27904"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27904",
          "url": "https://www.suse.com/security/cve/CVE-2026-27904"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1258994 for CVE-2026-27904",
          "url": "https://bugzilla.suse.com/1258994"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27904"
    },
    {
      "cve": "CVE-2026-33036",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33036"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (\u0026#NNN;, \u0026#xHH;) and standard XML entities completely evade the entity expansion limits (e.g., maxTotalExpansions, maxExpandedLength) added to fix CVE-2026-26278, enabling XML entity expansion Denial of Service. The root cause is that replaceEntitiesValue() in OrderedObjParser.js only enforces expansion counting on DOCTYPE-defined entities while the lastEntities loop handling numeric/standard entities performs no counting at all. An attacker supplying 1M numeric entity references like \u0026#65; can force ~147MB of memory allocation and heavy CPU usage, potentially crashing the process-even when developers have configured strict limits. This issue has been fixed in version 5.5.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33036",
          "url": "https://www.suse.com/security/cve/CVE-2026-33036"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259974 for CVE-2026-33036",
          "url": "https://bugzilla.suse.com/1259974"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33036"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268676 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1268676"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-33487",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33487"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element\u0027s ID. In Go versions before 1.22, or when `go.mod` uses an older version, there is a loop variable capture issue. The code takes the address of the loop variable `_ref` instead of its value. As a result, if more than one reference matches the ID or if the loop logic is incorrect, the `ref` pointer will always end up pointing to the last element in the `SignedInfo.References` slice after the loop. goxmlsig version 1.6.0 contains a patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33487",
          "url": "https://www.suse.com/security/cve/CVE-2026-33487"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33487"
    },
    {
      "cve": "CVE-2026-33814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33814",
          "url": "https://www.suse.com/security/cve/CVE-2026-33814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264506 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1264506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268758 for CVE-2026-33814",
          "url": "https://bugzilla.suse.com/1268758"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33814"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    },
    {
      "cve": "CVE-2026-39821",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39821"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39821",
          "url": "https://www.suse.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266474 for CVE-2026-39821",
          "url": "https://bugzilla.suse.com/1266474"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39821"
    },
    {
      "cve": "CVE-2026-39827",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39827"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39827",
          "url": "https://www.suse.com/security/cve/CVE-2026-39827"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39827",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39827"
    },
    {
      "cve": "CVE-2026-39828",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39828"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39828",
          "url": "https://www.suse.com/security/cve/CVE-2026-39828"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39828",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39828"
    },
    {
      "cve": "CVE-2026-39829",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39829"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39829",
          "url": "https://www.suse.com/security/cve/CVE-2026-39829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39829",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39829"
    },
    {
      "cve": "CVE-2026-39830",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39830"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39830",
          "url": "https://www.suse.com/security/cve/CVE-2026-39830"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39830",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39830"
    },
    {
      "cve": "CVE-2026-39831",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39831"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39831",
          "url": "https://www.suse.com/security/cve/CVE-2026-39831"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39831",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39831"
    },
    {
      "cve": "CVE-2026-39832",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39832"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39832",
          "url": "https://www.suse.com/security/cve/CVE-2026-39832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39832",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39832"
    },
    {
      "cve": "CVE-2026-39833",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39833"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39833",
          "url": "https://www.suse.com/security/cve/CVE-2026-39833"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39833",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39833"
    },
    {
      "cve": "CVE-2026-39834",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39834"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39834",
          "url": "https://www.suse.com/security/cve/CVE-2026-39834"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39834",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39834"
    },
    {
      "cve": "CVE-2026-39835",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39835"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39835",
          "url": "https://www.suse.com/security/cve/CVE-2026-39835"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-39835",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-39835"
    },
    {
      "cve": "CVE-2026-42039",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42039"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42039",
          "url": "https://www.suse.com/security/cve/CVE-2026-42039"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267406 for CVE-2026-42039",
          "url": "https://bugzilla.suse.com/1267406"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42039"
    },
    {
      "cve": "CVE-2026-42502",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42502"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42502",
          "url": "https://www.suse.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-42502",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42502"
    },
    {
      "cve": "CVE-2026-42506",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42506"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42506",
          "url": "https://www.suse.com/security/cve/CVE-2026-42506"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267044 for CVE-2026-42506",
          "url": "https://bugzilla.suse.com/1267044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42506"
    },
    {
      "cve": "CVE-2026-42508",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42508"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42508",
          "url": "https://www.suse.com/security/cve/CVE-2026-42508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-42508",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42508"
    },
    {
      "cve": "CVE-2026-46595",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46595"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46595",
          "url": "https://www.suse.com/security/cve/CVE-2026-46595"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46595",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46595"
    },
    {
      "cve": "CVE-2026-46597",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46597"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46597",
          "url": "https://www.suse.com/security/cve/CVE-2026-46597"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46597",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46597"
    },
    {
      "cve": "CVE-2026-46598",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-46598"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
          "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-46598",
          "url": "https://www.suse.com/security/cve/CVE-2026-46598"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266049 for CVE-2026-46598",
          "url": "https://bugzilla.suse.com/1266049"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.aarch64",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.ppc64le",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.s390x",
            "openSUSE Tumbleweed:velociraptor-0.7.0.4.git185.a5708584-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-25T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-46598"
    }
  ]
}