CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before version 23.0.1 , a vulnerability exists in the WebSocket transport where it fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token . An authenticated user with a valid token for one project can substitute another pr...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

EUVD-2026-94614

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

ittup (>=1.1.0, <=1.13.0rc5), mangadownloadlib (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-106057 via patool (>=4.0.0, <=4.0.5)

patool PYPI version =4.0.0, =1.1.0, =1.0.0, =0.1.0, =0.20250314.0, =0.12.1, =0.14.12 Source cves: CVE-2026-106057 Source advisory: MEND:CVE-2026-106057...

PT-2026-107673

Name of the Vulnerable Software and Affected Versions OpenStack Zaqar versions prior to 23.0.1 Description In deployments using the WebSocket transport with Keystone authentication, the system fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone...

CVE-2026-107363: External Control of Assumed-Immutable Web Parameter

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

GHSA-X33G-CR3X-6449 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.1, openstack-placement-2025.1-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips, openstack-nova-2025.1, openstack-placement-2026.1-fips, openstack-nova-2025.2, airflow, openstack-glance-2025.2-fips, datadog-agent, wazuh-manager,...

CVE-2026-102275 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2025.1, openstack-placement-2025.1-fips, openstack-horizon-2026.1, openstack-horizon-2026.1-fips, openstack-nova-2025.1, openstack-placement-2026.1-fips, openstack-nova-2025.2, airflow, openstack-glance-2025.2-fips, datadog-agent, wazuh-manager,...

CVE-2026-102991 vulnerabilities

Vulnerabilities for packages: openstack-cinder-2026.1, openstack-designate-2026.1, openstack-horizon-2025.1, jupyterhub-k8s-singleuser-sample, openstack-octavia-2025.2, openstack-placement-2025.1-fips, openstack-horizon-2026.1, openstack-barbican-2026.1, openstack-keystone-2025.1-fips,...

GHSA-5639-2J2P-M4MX vulnerabilities

Vulnerabilities for packages: openstack-cinder-2026.1, openstack-designate-2026.1, openstack-horizon-2025.1, jupyterhub-k8s-singleuser-sample, openstack-octavia-2025.2, openstack-placement-2025.1-fips, openstack-horizon-2026.1, openstack-barbican-2026.1, openstack-keystone-2025.1-fips,...

CVE-2026-51772

A flaw was found in OpenStack Glance. When the multiple locations configuration option is enabled, an authenticated attacker can perform Server-Side Request Forgery SSRF by submitting a crafted HTTP request to modify an image's location attributes. This vulnerability allows the attacker to induce...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenStack Aodh and Watcher vulnerability (USN-8870-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8870-1 advisory. Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the...

USN-8870-1 aodh, watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

USN-8870-1: OpenStack Aodh and Watcher vulnerability

Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alarm metadata or trigger unauthorized...

CVE-2026-44393 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, openstack-placement-2026.1, openstack-nova-2026.1, openstack-glance-2026.1, openstack-neutron-2026.1, openstack-keystone-2026.1-fips...

GHSA-76QH-XR7Q-H39M vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, openstack-placement-2026.1, openstack-nova-2026.1, openstack-glance-2026.1, openstack-neutron-2026.1, openstack-keystone-2026.1-fips...

CVE-2026-101918 vulnerabilities

Vulnerabilities for packages: openstack-cinder-2026.1, openstack-designate-2026.1, ggshield, openstack-horizon-2025.1, azureml-inference-server-http, mlrun, openstack-horizon-2026.1, openstack-barbican-2026.1, openstack-octavia-2025.2, openstack-keystone-2025.1-fips,...