Red Hat Openstack Platform 16.2 vulnerabilities

25 CVEs affecting Red Hat Openstack Platform 16.2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92982, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2024-3727, published 2024-05-14. High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion,…
CVE-2026-41283, published 2026-06-04. Critical severity, CVSS 9.9. EPSS: 0.9% chance of exploitation in the next 30 days. OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
CVE-2024-4438, published 2024-05-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red…
CVE-2024-4437, published 2024-05-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using…
CVE-2024-4436, published 2024-05-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Red Hat OpenStack platform is using…
CVE-2026-22797, published 2026-01-19. Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware…
CVE-2026-34956, published 2026-05-05. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-92091, published 2026-09-16. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not…

Latest

CVE-2026-92982, published 2026-10-15. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values.…
CVE-2026-84828, published 2026-09-10. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary…
CVE-2026-84185, published 2026-09-03. Medium severity, CVSS 5.9. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON…
CVE-2026-80179, published 2026-08-28. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the…
CVE-2026-11998, published 2026-06-24. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's…
CVE-2026-44393, published 2026-06-04. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When…