Red Hat OpenStack Platform 16.2/rhosp-rhel8/openstack-horizon

Red Hat · Package

15 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M	dnspython Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9	PyPIRed Hat	High	Fix reported	2026-11-12
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex elementCVE-2026-106435 · GHSA-98QM-WVGF-W4CF	pymongo Red Hat OpenShift AI (RHOAI)/rhoai/odh-llama-stack-core-rhel9	PyPIRed Hat	High	Fix reported	2026-10-27
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryptionCVE-2026-96747 · GHSA-QX36-8MW2-4R3XVersion ranges need review.	pymongo Red Hat OpenShift AI (RHOAI)/rhoai/odh-llama-stack-core-rhel9	PyPIRed Hat	Medium	Fix reported	2026-10-15
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimitersCVE-2026-96748 · GHSA-VP6J-J7W5-5XJJVersion ranges need review.	pymongo Red Hat OpenShift AI (RHOAI)/rhoai/odh-llama-stack-core-rhel9	PyPIRed Hat	High	Fix reported	2026-10-15
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methodsCVE-2026-88029 · GHSA-8FVV-FGR5-F8CHVersion ranges need review.	pymongo Red Hat OpenShift AI (RHOAI)/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9	PyPIRed Hat	Medium	Fix reported	2026-10-15
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsingCVE-2026-15307 · GHSA-WVQV-FJ8W-QMHMVersion ranges need review.	django Red Hat Ansible Automation Platform 2/ansible-automation-platform-25/ansible-dev-tools-rhel8	PyPIRed Hat	High	Fix reported	2026-10-01
WebOb: Open redirect in Location header normalization via leading C0 control / space charactersCVE-2026-54770 · GHSA-6HX8-3WJJ-GR8GVersion ranges need review.	webob Red Hat Ceph Storage 4/python-webob	PyPIRed Hat	Medium	Fix reported	2026-09-10
OpenStack Horizon RC file generation does not escape special characters in project namesCVE-2026-55748 · GHSA-6WRM-X65G-HR4PVersion ranges need review.	horizon Red Hat OpenStack Platform 13 (Queens)/rhosp13/openstack-horizon	PyPIRed Hat	Medium	No fix reported	2026-09-10
Django is vulnerable to SQL injection in column aliasesCVE-2025-13372 · GHSA-RQW2-GHQ9-44M7Version ranges need review.	django OpenShift Service Mesh 2/openshift-service-mesh/pilot-rhel8	PyPIRed Hat	Medium	Fix reported	2026-06-10
ironic: OpenStack Ironic: Information disclosure via crafted requestCVE-2026-71201	Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel8-operator Red Hat OpenShift Container Platform 4/openshift4/ose-baremetal-rhel9-operator	Red Hat	Medium	No fix reported	Not recorded
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmissionCVE-2026-84782	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Compute Attestation/agent-sandbox/agent-sandbox-router	Red Hat	High	No fix reported	Not recorded
django: Privilege abuse in model formsets with editable primary keysCVE-2026-87975	Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8	Red Hat	Medium	No fix reported	Not recorded
django: Server-side request forgery via unvalidated bytes in spatial lookupsCVE-2026-87890	Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8	Red Hat	Medium	No fix reported	Not recorded
django: Denial of service via quadratic parsing complexity in parse_header_parameters()CVE-2026-84429	Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8	Red Hat	Medium	No fix reported	Not recorded
django: Denial of service via unbounded caching of long language codes in get_supported_language_variant()CVE-2026-77050	Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8	Red Hat	Medium	No fix reported	Not recorded