953 matches found
CVE-2026-126955
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /page or /api/pages/page/content/ and compare 303/40...
CVE-2026-126954
Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title,...
CVE-2026-126955 Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /page or /api/pages/page/content/ and compare 303/40...
CVE-2026-126954
The Glance application (versions 0.7.9 before 0.8.8 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of proper input neutralization, allowing malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. An attacker contr...
EUVD-2026-125111
Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title,...
CVE-2026-126955
The Glance application (versions 0.8.0 before 0.8.8 ) is vulnerable to page slug enumeration due to an observable response discrepancy in the handlePageRequest and handlePageContentRequest functions. This flaw allows unauthenticated attackers to discover hidden page names by requesting candidate ...
EUVD-2026-125110
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /page or /api/pages/page/content/ and compare 303/40...
CVE-2026-126955 Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /page or /api/pages/page/content/ and compare 303/40...
CVE-2013-0212
CVE-2013-0212 Verison: https://github.com/openstack/glance/tree/4b768a4a847a0f5c857f4fe3f3bca720da9b3949...
CVE-2026-51772
A flaw was found in OpenStack Glance. When the multiple locations configuration option is enabled, an authenticated attacker can perform Server-Side Request Forgery SSRF by submitting a crafted HTTP request to modify an image's location attributes. This vulnerability allows the attacker to induce...
CVE-2026-44393 vulnerabilities
Vulnerabilities for packages: openstack-placement-2026.1, openstack-glance-2026.1, openstack-neutron-2026.1, openstack-keystone-2026.1, openstack-nova-2026.1, openstack-keystone-2026.1-fips...
GHSA-76QH-XR7Q-H39M vulnerabilities
Vulnerabilities for packages: openstack-placement-2026.1, openstack-glance-2026.1, openstack-neutron-2026.1, openstack-keystone-2026.1, openstack-nova-2026.1, openstack-keystone-2026.1-fips...
[SECURITY] [DLA 4800-1] glance security update
Debian LTS Advisory DLA-4800-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara September 29, 2026 https://wiki.debian.org/LTS Package : glance Version : 2:25.1.0-2+deb12u5 CVE ID : CVE-2026-71196 CVE-2026-71197 CVE-2026-71198 CVE-2026-77648 Debian Bug ...
Debian dla-4800 : glance - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4800 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4800-1 [email protected]...
Linux Distros Unpatched Vulnerability : CVE-2026-51772
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled ...
CVE-2026-51772
A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...
UBUNTU-CVE-2026-51772
A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...
CVE-2026-51772
A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...
CVE-2026-51772
A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...
PT-2026-98822
Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2. When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker ca...