GHSA-J5G9-F88F-GFJ3 vulnerabilities

Vulnerabilities for packages: openstack-nova-2026.1, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1-fips, openstack-horizon-2026.1, openstack-nova-2025.1, openstack-horizon-2025.2-fips, kubeflow-pipelines-visualization-server,...

CVE-2026-59939 vulnerabilities

Vulnerabilities for packages: openstack-nova-2026.1, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1-fips, openstack-horizon-2026.1, openstack-nova-2025.1, openstack-horizon-2025.2-fips, kubeflow-pipelines-visualization-server,...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, superset-fips, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1-fips, openstack-horizon-2026.1, openstack-horizon-2025.2-fips, httpie, datadog-agent-fips,...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, superset-fips, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1-fips, openstack-horizon-2026.1, openstack-horizon-2025.2-fips, httpie, datadog-agent-fips,...

PYSEC-2026-2519 OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

PYSEC-2026-2520 OpenStack Horizon has Incorrect Behavior Order

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix...

PYSEC-2026-821 OpenStack Horizon Cross-site Scripting (XSS)

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

OpenStack Horizon Cross-site Scripting (XSS)

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

PYSEC-2026-644 OpenStack Horizon Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

PYSEC-2026-641 OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting XSS vulnerability in the Host Aggregates interface in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name...

PYSEC-2026-642 Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

Cross-site scripting XSS vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject...

PYSEC-2026-643 OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in OpenStack Dashboard Horizon 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form...

CVE-2026-54911 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1-fips, openstack-horizon-2026.1, openstack-horizon-2025.2-fips, openstack-keystone-2025.1, openstack-placement-2025.2-fip...

GHSA-3J69-69WJ-XQX2 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2025.1-fips, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips, openstack-keystone-2026.1-fips, openstack-horizon-2026.1, openstack-horizon-2025.2-fips, openstack-keystone-2025.1, openstack-placement-2025.2-fip...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: synapse, dask-kubernetes, openstack-kolla-toolbox-2025.2, dask-kubernetes-fips, openstack-keystone-2025.1-fips, ansible-operator, dbt-core, superset-fips, openstack-horizon-2025.1, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips,...

Linux Distros Unpatched Vulnerability : CVE-2026-55748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some...

CVE-2026-55748

A flaw was found in OpenStack Horizon. This vulnerability allows a highly privileged remote attacker, with user interaction, to craft a project name containing shell metacharacters. When scripts for OpenStack RC file downloading are produced, these metacharacters may be processed, potentially...

OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...

GHSA-6WRM-X65G-HR4P OpenStack Horizon RC file generation does not escape special characters in project names

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability...