https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T23:06:05.235014+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2016-4972 CVE-2016-4972 2026-10-07T23:06:05.236601+00:00

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

 https://cve.radiocsirt.org/vuln/ghsa-87r7-q54j-f9qg GHSA-87r7-q54j-f9qg — OpenStack Murano Code Execution 2026-10-07T23:06:05.236647+00:00

Affected: PyPI: murano, PyPI: murano-dashboard, PyPI: python-muranoclient

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.