openSUSE / Libzypp
7 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-44941 | libzypp path traversal via "keyhint" in repomd.xml | HIGH | 8.8 | Jul 2, 2026 |
| CVE-2026-25707 | Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp | HIGH | 8.8 | Jun 29, 2026 |
| CVE-2019-18900 | libzypp stores cookies world readable | MEDIUM | 4.0 | Jan 24, 2020 |
| CVE-2018-7685 | libzypp does not reevaluate malicious rpms once downloaded | HIGH | 7.8 | Aug 31, 2018 |
| CVE-2017-9269 | lack of keypinning in libzypp could lead to repository switching | CRITICAL | 9.8 | Mar 1, 2018 |
| CVE-2017-7436 | libzypp accepts unsigned packages even when configured to check signatures | HIGH | 8.1 | Mar 1, 2018 |
| CVE-2017-7435 | libzypp accepts unsigned 3rd party repo without warning | HIGH | 8.1 | Mar 1, 2018 |
Showing 1 to 7 of 7 CVEs