Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Client Tools 15 package uyuni-tools, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVE-2026-27606 — CVSS 9.8 (critical): Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and…
CVE-2026-1615 — CVSS 9.8 (critical): Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path…
CVE-2023-3128 — CVSS 9.4 (critical): Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily…
CVE-2026-25547: @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is…
CVE-2024-45337 — CVSS 9.1 (critical): Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be…
CVE-2025-12816 — CVSS 8.6 (high): An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft…
CVE-2026-21721 — CVSS 8.1 (high): The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result…
CVE-2025-6023 — CVSS 7.6 (high): An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was…
CVE-2025-68156 — CVSS 7.5 (high): Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including…
CVE-2026-21720 — CVSS 7.5 (high): Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue…
CVE-2023-45142 — CVSS 7.5 (high): OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels…
CVE-2023-3978 — CVSS 6.1 (medium): Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to…
CVE-2024-6104 — CVSS 6.0 (medium): go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing…
CVE-2024-22037 — CVSS 5.5 (medium): The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be…
CVE-2023-6152 — CVSS 5.4 (medium): A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration…
CVE-2025-13465 — CVSS 5.3 (medium): Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass…
CVE-2025-11065 — CVSS 5.3 (medium): A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This…
CVE-2026-21722 — CVSS 5.3 (medium): Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This…
CVE-2024-8118: In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert…
CVE-2025-3415 — CVSS 4.3 (medium): Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected…
CVE-2025-6197 — CVSS 4.2 (medium): An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -…
CVE-2024-51744 — CVSS 3.1 (low): golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to…