Command and Code Injection

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.CVE-2013-2161Openstack · 1.9% likely

   CWE-94

2. In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host…CVE-2026-28370OpenStack · CVSS 9.1 · 0.8% likely

   CWE-95

3. In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into…CVE-2026-94572OpenStack · CVSS 9.4 · 0.5% likely

   CWE-94

4. In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL valida…CVE-2026-94571OpenStack · CVSS 9.4 · 0.5% likely

   CWE-94

5. In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciousl…CVE-2026-66138OpenStack · CVSS 7.2 · 0.5% likely

   CWE-78

6. In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gat…CVE-2026-93858OpenStack · CVSS 8.7 · 0.4% likely

   CWE-78

7. In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.CVE-2026-44916OpenStack · CVSS 3 · 0.3% likely

   CWE-1336

8. OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this…CVE-2026-55748OpenStack · CVSS 6 · 0.3% likely

   CWE-78

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.