Advisories · Technology

SUSE libzypp.

Every CVE that names SUSE libzypp among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-44941 CVE record

CVSS 8.4 High

libzypp path traversal via "keyhint" in repomd.xml
- SUSE libzypp
- Path traversal
Not analysed yet 2 Jul 2026
CVE-2026-25707 CVE record

CVSS 8.8 High

Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
- SUSE libzypp
- Path traversal
Not analysed yet 29 Jun 2026
CVE-2026-44942 CVE record

CVSS 6.5 Medium

libzypp .repo files can have an optional path which can lead to path traversal attacks
- SUSE libzypp
- Path traversal
Not analysed yet 18 Jun 2026
CVE-2018-7685 CVE record

CVSS 7.8 High

libzypp does not reevaluate malicious rpms once downloaded
- SUSE libzypp
- CWE-358
Not analysed yet 31 Aug 2018
CVE-2017-9269 CVE record

CVSS 7.7 High

lack of keypinning in libzypp could lead to repository switching
- SUSE libzypp
- CWE-757
Not analysed yet 1 Mar 2018
CVE-2017-7436 CVE record

CVSS 8.1 High

libzypp accepts unsigned packages even when configured to check signatures
- SUSE libzypp
Not analysed yet 1 Mar 2018
CVE-2017-7435 CVE record

CVSS 8.1 High

libzypp accepts unsigned 3rd party repo without warning
- SUSE libzypp
Not analysed yet 1 Mar 2018