nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

Impact In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoi...

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoint also...

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoint also...

PT-2026-36862

Impact In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoi...

PT-2026-37175

Name of the Vulnerable Software and Affected Versions nova-toggle-5 versions prior to 1.3.0 Description The toggle endpoint "POST /nova-vendor/nova-toggle/toggle/resource/resourceId" was protected only by web and auth: middleware. This allowed any user authenticated on the configured guard to fli...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dkron, pluto, polaris, dgraph, apko, metacontroller, smarter-device-manager, newrelic-k8s-metadata-injection, flux-image-reflector-controller, external-secrets-operator, dataplaneapi, grafana-operator, victoriametrics, ingress-nginx-controller, volume-modifier-for-k8...

aiowhitebit-mcp (>=0.2.2, <=0.2.4), antdigital-aico-guard-mcp-server (>=0.1.0, <=0.1.3) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.2.5)

fastmcp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aiowhitebit-mcp =0.2.2, =0.1.0, =0.2.1, =3.2.2 - spoon-ai-sdk 0.1.3 - spoon-toolkits 0.1.3 Source cves: CVE-2026-32871 Source advisory:...

aiowhitebit-mcp (>=0.2.2, <=0.2.4), antdigital-aico-guard-mcp-server (>=0.1.0, <=0.1.3) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.2.5)

fastmcp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aiowhitebit-mcp =0.2.2, =0.1.0, =0.2.1, =3.2.2 - spoon-ai-sdk 0.1.3 - spoon-toolkits 0.1.3 Source cves: CVE-2026-27124 Source advisory:...

agentstack-cli (>=0.5.0rc4, <=0.7.1), amiibo-converter (0.2.0) +265 more potentially affected by CVE-2026-34073 via cryptography (>=46.0.0, <=46.0.5)

cryptography PYPI version =46.0.0, =0.5.0rc4, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1, =0.13.12, =0.1.3, =3.8.9, =0.2.50, =0.2.57 and more Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

Debian: Security Advisory (DLA-4486-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4486-1] nova security update

Debian LTS Advisory DLA-4486-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara February 20, 2026 https://wiki.debian.org/LTS Package : nova Version : 2:22.4.0-1deb11u7 CVE ID : CVE-2026-24708 Debian Bug : 1128294 Dan Smith discovered that nova, a cloud...

Debian dla-4486 : nova-api - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4486 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4486-1 [email protected] https://www.debian.org/lts/security/...

DLA-4486-1 nova - security update

Bulletin has no description...

Debian: Security Advisory (DSA-6145-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 6145-1] nova security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6145-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 19, 2026 https://www.debian.org/security/faq -...

DSA-6145-1 nova - security update

Bulletin has no description...

Debian dsa-6145 : nova-api - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6145 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6145-1 [email protected] https://www.debian.org/security/...

Ubuntu: Security Advisory (USN-8049-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-M4F3-QP2W-GWH6 OpenStack Nova calls qemu-img without format restrictions for resize

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in a...

OpenStack Nova calls qemu-img without format restrictions for resize

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in a...