Veille CVE

Vendredi 23 octobre 2026

3 CVE

Critique 0 Élevée 0 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenStack Ironic » ✕
  1. CVE-2026-90458 5.4 Moyenne

    OpenStack Ironic

    OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.

  2. CVE-2026-89419 5.0 Moyenne

    OpenStack Ironic

    OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint.

  3. CVE-2026-115638 4.3 Moyenne

    OpenStack Ironic

    OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.