GHSA-H7PC-VWP9-298G vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-8404 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-6873 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-8CJM-8MP7-R2XF vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-48587 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-923M-GV2P-W5QP vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-53878 vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-3H9F-R86X-QVJX vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-CRHF-3PFG-W68W vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

GHSA-8QCX-XF44-272X vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-53877 vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

CVE-2026-48588 vulnerabilities

Vulnerabilities for packages: authentik-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

Nova noVNC - Open Redirect

Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-3654 info: name: Nova noVNC - Open Redirect author: geeknik severity: medium...

CVE-2026-71190

A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causin...

CVE-2026-71192

A flaw was found in the S3API middleware of OpenStack Swift. When configured with s3acl=true non-default, Swift-native control headers such as X-Copy-From and X-Copy-From-Account are not sanitized from S3 API requests. Because the S3 ACL mode bypasses Swift's native authorization, an authenticate...

CVE-2026-71191

A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz- headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects...

CVE-2026-71201

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project...

CVE-2026-71201

OpenStack Ironic up to version 38.0.0 is affected. A crafted request from a project reader can cause Portgroups assigned to Nodes owned or leased by another project to be returned, enabling cross-project information disclosure. The CVSS 3.1 base score is 5.0 (MEDIUM) with Network attack vector an...

EUVD-2026-53124

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project...

CVE-2026-71201

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project...