8638 matches found
CVE-2026-71201: Incorrect Authorization
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project...
PT-2026-67950
Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 28.0.2 Description The subnetpool onboarding API fails to verify the ownership of target subnets. This allows an authenticated user to onboard subnets belonging to another project's shared network into their...
CVE-2026-71191: Incorrect Authorization
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
Linux Distros Unpatched Vulnerability : CVE-2026-71191
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. ...
Linux Distros Unpatched Vulnerability : CVE-2026-71201
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another...
Linux Distros Unpatched Vulnerability : CVE-2026-71192
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests whe...
CVE-2026-71192: Incorrect Authorization
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...
Linux Distros Unpatched Vulnerability : CVE-2026-71190
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The qdtext...
GHSA-G6CJ-PR64-35W5 vulnerabilities
Vulnerabilities for packages: dask-kubernetes-fips, openstack-glance-2025.2, request-1276, openstack-nova-2025.1, openstack-placement-2026.1, litellm, openstack-horizon-2025.2, awx, ansible-operator-fips, datadog-agent-fips, openstack-keystone-2025.1, openstack-nova-2025.2, vllm-cuda-13.2,...
CVE-2026-69247 vulnerabilities
Vulnerabilities for packages: dask-kubernetes-fips, openstack-glance-2025.2, request-1276, openstack-nova-2025.1, openstack-placement-2026.1, litellm, openstack-horizon-2025.2, awx, ansible-operator-fips, datadog-agent-fips, openstack-keystone-2025.1, openstack-nova-2025.2, vllm-cuda-13.2,...
[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43
Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...
[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44
Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...
GHSA-J5G9-F88F-GFJ3 vulnerabilities
Vulnerabilities for packages: openstack-glance-2025.2, authentik-fips, openstack-nova-2025.1, openstack-keystone-2026.1-fips, openstack-placement-2025.1-fips, openstack-placement-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-horizon-2026.1, openstack-keystone-2026.1,...
CVE-2026-59939 vulnerabilities
Vulnerabilities for packages: openstack-glance-2025.2, authentik-fips, openstack-nova-2025.1, openstack-keystone-2026.1-fips, openstack-placement-2025.1-fips, openstack-placement-2026.1, openstack-horizon-2025.2, openstack-keystone-2025.1, openstack-horizon-2026.1, openstack-keystone-2026.1,...
Linux Distros Unpatched Vulnerability : CVE-2026-54422
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic- python-agent, may be able to extract the credentials...
Linux Distros Unpatched Vulnerability : CVE-2026-66139
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. CVE-2026-66139 Note that Nessus relies on the presenc...
CVE-2026-54422
A flaw was found in OpenStack ironic-python-agent's bootc container deployment support. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator...
CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
