airo-heat

airoheat Repository of the T1GR3$ team at the Cybercamp 2018 hackathon Final presentation at Cybercamp 2018: https://www.youtube.com/watch?v=l-iBtYxHAbQ Video used at Cybercamp 2018: https://www.youtube.com/watch?v=0DEitQNn7GQ Aircrack-ng Installation modification sudo apt-get install...

WordPress heat-trackr 1.0 - Cross-Site Scripting

WordPress heat-trackr 1.0 contains a cross-site scripting vulnerability via heat-trackrabtestadd.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

CVE-2026-102266 vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2, openstack-placement-2025.1,...

CVE-2026-102269 vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, airflow, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2,...

GHSA-R6X4-923Q-G947 vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2, openstack-placement-2025.1,...

GHSA-9V7F-9G4P-FFGJ vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, airflow, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2,...

CVE-2026-101917 vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, airflow, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2,...

CVE-2026-102267 vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, airflow, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2,...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: kserve-huggingfaceserver-cuda-13.3, openstack-manila-2026.1, azureml-inference-server-http, metaflow-service-fips, airflow, openstack-glance-2025.1, openstack-keystone-2025.1-fips, superset, openstack-octavia-2025.2, openstack-horizon-2025.2,...

openstack-heat may disclose sensitive information

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied...

PYSEC-2026-1750 openstack-heat may disclose sensitive information

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied...

PYSEC-2026-1751 OpenStack Heat information leak vulnerability

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system...

OpenStack Heat information leak vulnerability

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system...

PYSEC-2026-889 OpenStack Heat template URL information leakage

OpenStack Orchestration API Heat 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list...

OpenStack Heat template URL information leakage

OpenStack Orchestration API Heat 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list...

PYSEC-2026-822 OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard aka Horizon 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template...

OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard aka Horizon 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template...

PYSEC-2026-754 Openstack tripleo-heat-templates unauthenticated file access

A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...

Openstack tripleo-heat-templates unauthenticated file access

A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

Cross-site scripting XSS vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject...