https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:03:35 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44917 <p><strong>Affected:</strong> OpenStack Ironic</p> <p>OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.</p> <p><strong>Affected:</strong> OpenStack Ironic</p> <p>OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.</p> https://cve.radiocsirt.org/vuln/cve-2026-44917 https://cve.radiocsirt.org/vuln/usn-8421-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ironic, Ubuntu:24.04:LTS: ironic, Ubuntu:25.10: ironic, Ubuntu:26.04:LTS: ironic</p> <p>Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor. (CVE-2026-48681)</p> <p>Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate kernel command line parameters. A privileged authenticated remote user could use this issue to inject scripts during node boot and possibly execute arbitrary code. (CVE-2026-46447)</p> <p>Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic incorrectly restricted access to custom PXE templates. A privileged authenticated remote user could use this issue to read arbitrary sensitive files on the Ironic conductor. (CVE-2026-44917)</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: ironic, Ubuntu:24.04:LTS: ironic, Ubuntu:25.10: ironic, Ubuntu:26.04:LTS: ironic</p> <p>Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor. (CVE-2026-48681)</p> <p>Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate kernel command line parameters. A privileged authenticated remote user could use this issue to inject scripts during node boot and possibly execute arbitrary code. (CVE-2026-46447)</p> <p>Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic incorrectly restricted access to custom PXE templates. A privileged authenticated remote user could use this issue to read arbitrary sensitive files on the Ironic conductor. (CVE-2026-44917)</p> https://cve.radiocsirt.org/vuln/usn-8421-1