GHSA-8QCX-XF44-272X vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1-fips, authentik, openstack-horizon-2026.1...

GHSA-G6CJ-PR64-35W5 vulnerabilities

Vulnerabilities for packages: authentik, litellm, openstack-tempest-2026.1, openstack-horizon-2025.2, duplicity, kubeflow, openstack-placement-2026.1, in-toto, openstack-nova-2025.1, openstack-tempest-2025.2, lmcache-cuda-12.8, openstack-keystone-2025.1, openstack-kolla-toolbox-2026.1,...

CVE-2026-69247 vulnerabilities

Vulnerabilities for packages: authentik, litellm, openstack-tempest-2026.1, openstack-horizon-2025.2, duplicity, kubeflow, openstack-placement-2026.1, in-toto, openstack-nova-2025.1, openstack-tempest-2025.2, lmcache-cuda-12.8, openstack-keystone-2025.1, openstack-kolla-toolbox-2026.1,...

GHSA-J5G9-F88F-GFJ3 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik, openstack-placement-2025.2-fips, openstack-horizon-2025.2, duplicity, openstack-horizon-2025.2-fips, openstack-keystone-2025.1-fips, openstack-placement-2026.1, openstack-placement-2026.1-fips, openstack-nova-2025.1,...

CVE-2026-59939 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik, openstack-placement-2025.2-fips, openstack-horizon-2025.2, duplicity, openstack-horizon-2025.2-fips, openstack-keystone-2025.1-fips, openstack-placement-2026.1, openstack-placement-2026.1-fips, openstack-nova-2025.1,...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, authentik, openstack-placement-2025.2-fips, openstack-tempest-2026.1, openstack-horizon-2025.2, text-generation-inference, duplicity, openstack-horizon-2025.2-fips, openstack-keystone-2025.1-fips, nvidia-nsight-compute-13.3,...

OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

PYSEC-2026-2519 OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

PYSEC-2026-2520 OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

PT-2026-59180

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

PYSEC-2026-821 OpenStack Horizon Cross-site Scripting (XSS)

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

OpenStack Horizon Cross-site Scripting (XSS)

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

PYSEC-2026-641 OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

PYSEC-2026-642 Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

Cross-site scripting XSS vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject...

GHSA-3J69-69WJ-XQX2 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2025.1-fips, openstack-horizon-2025.2-fips, openstack-placement-2026.1, openstack-placement-2026.1-fips, openstack-keystone-2025.1,...

CVE-2026-54911 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2, openstack-keystone-2025.1-fips, openstack-horizon-2025.2-fips, openstack-placement-2026.1, openstack-placement-2026.1-fips, openstack-keystone-2025.1,...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: graalvm, authentik, openstack-horizon-2026.1-fips, openstack-placement-2025.2-fips, openstack-horizon-2025.2, openstack-tempest-2026.1, openstack-keystone-2025.1-fips, openstack-horizon-2025.2-fips, nvidia-nsight-compute-13.3, openstack-placement-2026.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-55748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some...