OPENSUSE-SU-2026:12300-1
Vulnerability from csaf_opensuse - Published: 2026-10-27 00:00 - Updated: 2026-10-28 11:19Summary
kumactl-3.0.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: kumactl-3.0.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the kumactl-3.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12300
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
8.1 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2024-45337
Threats
Impact
moderate
References
49 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "kumactl-3.0.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the kumactl-3.0.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-12300",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12300-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45337 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45337/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45338 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-51744 page",
"url": "https://www.suse.com/security/cve/CVE-2024-51744/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22869 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22869/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22872 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22872/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-30204 page",
"url": "https://www.suse.com/security/cve/CVE-2025-30204/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47913 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47913/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47914 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47914/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58181 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58181/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-26958 page",
"url": "https://www.suse.com/security/cve/CVE-2026-26958/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41178 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41178/"
}
],
"title": "kumactl-3.0.0-1.1 on GA media",
"tracking": {
"current_release_date": "2026-10-28T11:19:29Z",
"generator": {
"date": "2026-10-27T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:12300-1",
"initial_release_date": "2026-10-27T00:00:00Z",
"revision_history": [
{
"date": "2026-10-27T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-28T11:19:29Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kumactl-0:3.0.0-1.1.aarch64",
"product": {
"name": "kumactl-0:3.0.0-1.1.aarch64",
"product_id": "kumactl-0:3.0.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl@3.0.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"product": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"product_id": "kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-bash-completion@3.0.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"product": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"product_id": "kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-fish-completion@3.0.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"product": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"product_id": "kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-zsh-completion@3.0.0-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "kumactl-0:3.0.0-1.1.ppc64le",
"product": {
"name": "kumactl-0:3.0.0-1.1.ppc64le",
"product_id": "kumactl-0:3.0.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl@3.0.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"product": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"product_id": "kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-bash-completion@3.0.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"product": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"product_id": "kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-fish-completion@3.0.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"product": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"product_id": "kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-zsh-completion@3.0.0-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "kumactl-0:3.0.0-1.1.s390x",
"product": {
"name": "kumactl-0:3.0.0-1.1.s390x",
"product_id": "kumactl-0:3.0.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl@3.0.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "kumactl-bash-completion-0:3.0.0-1.1.s390x",
"product": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.s390x",
"product_id": "kumactl-bash-completion-0:3.0.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-bash-completion@3.0.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "kumactl-fish-completion-0:3.0.0-1.1.s390x",
"product": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.s390x",
"product_id": "kumactl-fish-completion-0:3.0.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-fish-completion@3.0.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"product": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"product_id": "kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-zsh-completion@3.0.0-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "kumactl-0:3.0.0-1.1.x86_64",
"product": {
"name": "kumactl-0:3.0.0-1.1.x86_64",
"product_id": "kumactl-0:3.0.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl@3.0.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"product": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"product_id": "kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-bash-completion@3.0.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"product": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"product_id": "kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-fish-completion@3.0.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kumactl-zsh-completion-0:3.0.0-1.1.x86_64",
"product": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.x86_64",
"product_id": "kumactl-zsh-completion-0:3.0.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/kumactl-zsh-completion@3.0.0-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-0:3.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64"
},
"product_reference": "kumactl-0:3.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-0:3.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le"
},
"product_reference": "kumactl-0:3.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-0:3.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x"
},
"product_reference": "kumactl-0:3.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-0:3.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64"
},
"product_reference": "kumactl-0:3.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64"
},
"product_reference": "kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le"
},
"product_reference": "kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x"
},
"product_reference": "kumactl-bash-completion-0:3.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-bash-completion-0:3.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64"
},
"product_reference": "kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64"
},
"product_reference": "kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le"
},
"product_reference": "kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x"
},
"product_reference": "kumactl-fish-completion-0:3.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-fish-completion-0:3.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64"
},
"product_reference": "kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64"
},
"product_reference": "kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le"
},
"product_reference": "kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x"
},
"product_reference": "kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kumactl-zsh-completion-0:3.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
},
"product_reference": "kumactl-zsh-completion-0:3.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45337",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45337"
}
],
"notes": [
{
"category": "general",
"text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45337",
"url": "https://www.suse.com/security/cve/CVE-2024-45337"
},
{
"category": "external",
"summary": "SUSE Bug 1234482 for CVE-2024-45337",
"url": "https://bugzilla.suse.com/1234482"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2024-45337"
},
{
"cve": "CVE-2024-45338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45338"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45338",
"url": "https://www.suse.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "SUSE Bug 1234794 for CVE-2024-45338",
"url": "https://bugzilla.suse.com/1234794"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-45338"
},
{
"cve": "CVE-2024-51744",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-51744"
}
],
"notes": [
{
"category": "general",
"text": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-51744",
"url": "https://www.suse.com/security/cve/CVE-2024-51744"
},
{
"category": "external",
"summary": "SUSE Bug 1232936 for CVE-2024-51744",
"url": "https://bugzilla.suse.com/1232936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-51744"
},
{
"cve": "CVE-2025-22869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22869"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22869",
"url": "https://www.suse.com/security/cve/CVE-2025-22869"
},
{
"category": "external",
"summary": "SUSE Bug 1239322 for CVE-2025-22869",
"url": "https://bugzilla.suse.com/1239322"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-22869"
},
{
"cve": "CVE-2025-22872",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22872"
}
],
"notes": [
{
"category": "general",
"text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22872",
"url": "https://www.suse.com/security/cve/CVE-2025-22872"
},
{
"category": "external",
"summary": "SUSE Bug 1241710 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1241710"
},
{
"category": "external",
"summary": "SUSE Bug 1265255 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265255"
},
{
"category": "external",
"summary": "SUSE Bug 1265256 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265256"
},
{
"category": "external",
"summary": "SUSE Bug 1265259 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265259"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-22872"
},
{
"cve": "CVE-2025-30204",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-30204"
}
],
"notes": [
{
"category": "general",
"text": "golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function\u0027s argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-30204",
"url": "https://www.suse.com/security/cve/CVE-2025-30204"
},
{
"category": "external",
"summary": "SUSE Bug 1240441 for CVE-2025-30204",
"url": "https://bugzilla.suse.com/1240441"
},
{
"category": "external",
"summary": "SUSE Bug 1240442 for CVE-2025-30204",
"url": "https://bugzilla.suse.com/1240442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-30204"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-47913",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47913"
}
],
"notes": [
{
"category": "general",
"text": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47913",
"url": "https://www.suse.com/security/cve/CVE-2025-47913"
},
{
"category": "external",
"summary": "SUSE Bug 1253506 for CVE-2025-47913",
"url": "https://bugzilla.suse.com/1253506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-47913"
},
{
"cve": "CVE-2025-47914",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47914"
}
],
"notes": [
{
"category": "general",
"text": "SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47914",
"url": "https://www.suse.com/security/cve/CVE-2025-47914"
},
{
"category": "external",
"summary": "SUSE Bug 1253967 for CVE-2025-47914",
"url": "https://bugzilla.suse.com/1253967"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-47914"
},
{
"cve": "CVE-2025-58181",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58181"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58181",
"url": "https://www.suse.com/security/cve/CVE-2025-58181"
},
{
"category": "external",
"summary": "SUSE Bug 1253784 for CVE-2025-58181",
"url": "https://bugzilla.suse.com/1253784"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-58181"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-26958",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-26958"
}
],
"notes": [
{
"category": "general",
"text": "filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Point).MultiScalarMult is called on an initialized point that is not the identity point, it returns an incorrect result. If the method is called on an uninitialized point, the behavior is undefined. In particular, if the receiver is the zero value, MultiScalarMult returns an invalid point that compares Equal to every other point. Note that MultiScalarMult is a rarely used, advanced API. For example, users who depend on filippo.io/edwards25519 only through github.com/go-sql-driver/mysql are not affected. This issue has been fixed in version 1.1.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-26958",
"url": "https://www.suse.com/security/cve/CVE-2026-26958"
},
{
"category": "external",
"summary": "SUSE Bug 1258570 for CVE-2026-26958",
"url": "https://bugzilla.suse.com/1258570"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-26958"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-41178",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41178"
}
],
"notes": [
{
"category": "general",
"text": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41178",
"url": "https://www.suse.com/security/cve/CVE-2026-41178"
},
{
"category": "external",
"summary": "SUSE Bug 1276509 for CVE-2026-41178",
"url": "https://bugzilla.suse.com/1276509"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-bash-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-fish-completion-0:3.0.0-1.1.x86_64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.aarch64",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.s390x",
"openSUSE Tumbleweed:kumactl-zsh-completion-0:3.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-27T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-41178"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.