Server-Side Request Forgery

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location…CVE-2026-71198OpenStack · CVSS 7 · 0.4% likely

   CWE-918

2. In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service…CVE-2026-77648OpenStack · CVSS 2.2 · 0.3% likely

   CWE-918

3. OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL va…CVE-2026-34881OpenStack · CVSS 5 · 0.3% likely

   CWE-918

4. In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requ…CVE-2026-50221OpenStack · CVSS 5.3 · 0.2% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.