CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

brawl-public-game-001

BRAWL Uno de los problemas desafiantes para los investigadores de ciberseguridad que desarrollan capacidades de detección y respuesta es encontrar un entorno realista para probar sus hipótesis y capacidades. El método más económico es probar capacidades en una pequeña red de laboratorio. Pero est...

GHSA-GF2Q-J2QQ-PJF2 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

GHSA-MRXV-65RV-6HXQ vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2012-3542 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

CVE-2012-4413 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.2...

Linux Distros Unpatched Vulnerability : CVE-2026-93861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further...

Linux Distros Unpatched Vulnerability : CVE-2026-97147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then...

CVE-2026-93861

A flaw was found in OpenStack Mistral. An authenticated project that has been granted and accepted access to another project's private workflow can further delegate that access to a third, arbitrary project without the workflow owner's knowledge or consent. The unauthorized delegation succeeds...

CVE-2026-93860

A flaw was found in OpenStack Mistral. The maintenance API endpoint is missing an authorization check, allowing any authenticated user to activate global maintenance mode on the Mistral service. When an attacker triggers maintenance mode, all write operations workflow execution creation,...

CVE-2026-93858

A flaw was found in OpenStack Mistral. The std.sshproxied built-in action accepts a user-supplied proxycommand parameter that is passed without validation to a system subprocess call on the Mistral executor host. An authenticated attacker can craft a malicious workflow that supplies an arbitrary...

CVE-2026-97147

A flaw was found in OpenStack Mistral. Due to a missing authorization check in the action definition and environment update paths, an authenticated user can modify or overwrite another project's publicly-scoped action definitions and environments. An attacker with a valid account in any project c...

DEBIAN-CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

DEBIAN-CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

DEBIAN-CVE-2026-93858

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

CVE-2026-93858

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

UBUNTU-CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...