8212 matches found
CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...
CVE-2026-55707
CVE-2026-55707 affects OpenStack Neutron before 28.0.2. The subnetpool onboarding API (PUT /v2.0/subnetpools/{id}/onboard_network_subnets) does not verify subnet ownership, allowing an authenticated but lower-privileged user to onboard subnets from another project’s shared network into their own ...
CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...
CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...
Linux Distros Unpatched Vulnerability : CVE-2026-71201
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another...
Linux Distros Unpatched Vulnerability : CVE-2026-71192
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests whe...
Linux Distros Unpatched Vulnerability : CVE-2026-71190
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The qdtext...
GHSA-G6CJ-PR64-35W5 vulnerabilities
Vulnerabilities for packages: opal, openstack-keystone-2025.1, k8s-sidecar, openstack-nova-2025.2, litellm, openstack-glance-2025.2, openstack-horizon-2026.1, airflow, semgrep, ansible-operator-fips, openstack-kolla-toolbox-2025.1, gitlab-cng-fips, openstack-horizon-2025.1, barman,...
CVE-2026-69247 vulnerabilities
Vulnerabilities for packages: opal, openstack-keystone-2025.1, k8s-sidecar, openstack-nova-2025.2, litellm, openstack-glance-2025.2, openstack-horizon-2026.1, airflow, semgrep, ansible-operator-fips, openstack-kolla-toolbox-2025.1, gitlab-cng-fips, openstack-horizon-2025.1, barman,...
[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43
Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...
[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44
Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...
GHSA-J5G9-F88F-GFJ3 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, openstack-keystone-2025.1, openstack-placement-2026.1-fips, openstack-keystone-2025.2-fips, openstack-nova-2025.2, openstack-horizon-2026.1, openstack-glance-2025.2, openstack-glance-2026.1-fips, openstack-nova-2025.1,...
CVE-2026-59939 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, openstack-keystone-2025.1, openstack-placement-2026.1-fips, openstack-keystone-2025.2-fips, openstack-nova-2025.2, openstack-horizon-2026.1, openstack-glance-2025.2, openstack-glance-2026.1-fips, openstack-nova-2025.1,...
Linux Distros Unpatched Vulnerability : CVE-2026-54422
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic- python-agent, may be able to extract the credentials...
Linux Distros Unpatched Vulnerability : CVE-2026-66139
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. CVE-2026-66139 Note that Nessus relies on the presenc...
CVE-2026-54422
A flaw was found in OpenStack ironic-python-agent's bootc container deployment support. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator...
CVE-2026-66138
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...
CVE-2026-66139
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known...
