Read this mailing list thread and weep:
https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/QELCQ4NGQOIZUWLNS3ZW3OUVCOLLCYFB/
TLDR: Leap 16’s “release pipeline” for regular updates is broken since April 9th. So no updated rpms are published into https://download.opensuse.org/distribution/leap/16.0/repo/oss/.
However, at the same time, builds in OBS repositories such as VirtualBox and KDE are proceeding using updated (and unreleased!!!) openSSL, etc packages - that are “stuck” in that “release pipeline” - and then OBS repositories continue to publish these new rpms - which are unusable because no one can get hold of the required dependencies. Hence the issues everyone is having.
At at the same time, there has been absolutely no communication to Leap 16 users about this.
And the responses on the mailing list from SuSE people are, basically, yeah, so what, to put it mildly. Unbelievable.