SUSE libzypp vulnerabilities

7 published CVEs name SUSE libzypp among the affected products.

Newest CVEs

CVE-2026-44941
libzypp path traversal via "keyhint" in repomd.xml
SUSE · libzypp
High8.4
CVE-2026-25707
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
SUSE · libzypp
High8.8
CVE-2026-44942
libzypp .repo files can have an optional path which can lead to path traversal attacks
SUSE · libzypp
Medium6.5
CVE-2018-7685
libzypp does not reevaluate malicious rpms once downloaded
SUSE · libzypp
High7.8
CVE-2017-9269
lack of keypinning in libzypp could lead to repository switching
SUSE · libzypp
High7.7
CVE-2017-7436
libzypp accepts unsigned packages even when configured to check signatures
SUSE · libzypp
High8.1
CVE-2017-7435
libzypp accepts unsigned 3rd party repo without warning
SUSE · libzypp
High8.1