GHSA-CX6F-VJHG-G3CC vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-cassandra-medusa, request-1276, openstack-rally-2025.2, openstack-rally-2026.1...

CVE-2026-115586 vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-cassandra-medusa, request-1276, openstack-rally-2025.2, openstack-rally-2026.1...

GHSA-4F8H-VR72-P32C vulnerabilities

Vulnerabilities for packages: nemo-gym, nemo-rl-cuda-13.0, py3-cassandra-medusa, request-1276, openstack-rally-2025.2, openstack-rally-2026.1...

DEBIAN-CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the specific maintenance endpoint...

DEBIAN-CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the specific maintenance endpoint...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

DEBIAN-CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...

CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...

UBUNTU-CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the specific maintenance endpoint...

UBUNTU-CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

EUVD-2026-108574

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-90458

OpenStack Ironic versions prior to 39.0.1 are vulnerable to a path traversal vulnerability within the Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges can use a crafted subscription id to perform GET or DELETE operations on arbitrary...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the specific maintenance endpoint...

CVE-2026-89419

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/ident - in other words, not using the specific maintenance endpoint...