SUSE libzypp vulnerabilities

CVEs per yearBy the year they were published

1. 20184
2. 20263

Newest CVEs

• CVE-2026-44941

  libzypp path traversal via "keyhint" in repomd.xml

  SUSE · libzypp

  High8.4
• CVE-2026-25707

  Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp

  SUSE · libzypp

  High8.8
• CVE-2026-44942

  libzypp .repo files can have an optional path which can lead to path traversal attacks

  SUSE · libzypp

  Medium6.5
• CVE-2018-7685

  libzypp does not reevaluate malicious rpms once downloaded

  SUSE · libzypp

  High7.8
• CVE-2017-9269

  lack of keypinning in libzypp could lead to repository switching

  SUSE · libzypp

  High7.7
• CVE-2017-7436

  libzypp accepts unsigned packages even when configured to check signatures

  SUSE · libzypp

  High8.1
• CVE-2017-7435

  libzypp accepts unsigned 3rd party repo without warning

  SUSE · libzypp

  High8.1