# Opensuse Leap


- [CVE-2020-16846](https://insights.sbomify.com/CVE-2020-16846/): SaltStack Salt Shell Injection (critical 9.8, exploited in the wild)
- [CVE-2020-12641](https://insights.sbomify.com/CVE-2020-12641/): Roundcube Webmail Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-11651](https://insights.sbomify.com/CVE-2020-11651/): SaltStack Salt Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2020-1938](https://insights.sbomify.com/CVE-2020-1938/): Apache Tomcat Improper Privilege Management (critical 9.8, exploited in the wild)
- [CVE-2016-3427](https://insights.sbomify.com/CVE-2016-3427/): Oracle Java SE and JRockit Unspecified (critical 9.8, exploited in the wild)
- [CVE-2025-32463](https://insights.sbomify.com/CVE-2025-32463/): Sudo Inclusion of Functionality from Untrusted Control Sphere (critical 9.3, exploited in the wild)
- [CVE-2020-16009](https://insights.sbomify.com/CVE-2020-16009/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2019-13720](https://insights.sbomify.com/CVE-2019-13720/): Google Chrome WebAudio Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2016-1646](https://insights.sbomify.com/CVE-2016-1646/): Google Chromium V8 Out-of-Bounds Read (high 8.8, exploited in the wild)
- [CVE-2016-3714](https://insights.sbomify.com/CVE-2016-3714/): ImageMagick Improper Input Validation (high 8.4, exploited in the wild)
- [CVE-2026-31431](https://insights.sbomify.com/CVE-2026-31431/): Linux Kernel Incorrect Resource Transfer Between Spheres (high 7.8, exploited in the wild)
- [CVE-2019-0211](https://insights.sbomify.com/CVE-2019-0211/): Apache HTTP Server Privilege Escalation (high 7.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/products/opensuse/leap/