Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

horizon

14 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 2 medium
Registry
PyPI

Advisories 14

  • CVE-2026-55748Medium 6.0

    OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell…

    Affected: through 25.7.3.

  • CVE-2026-43002Medium 5.3

    An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3.

    Affected: from 25.6, fixed in 25.7.3.

  • Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

    Affected: from 19.4.0, fixed in 20.2.0.

  • An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x.

    Affected: from 15.3.0, fixed in 15.3.2; from 16.0.0, fixed in 16.2.1; from 17.0.0, fixed in 18.3.3; from 18.4.0, fixed in 18.6.0; fixed in 15.3.2; from 16.0.0, fixed in 16.2.1; from 17.0.0, fixed in 18.3.3; from 18.4.0, fixed in 18.6.0.

  • OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via…

    Affected: from 9.0, fixed in 9.1.2; from 10.0, fixed in 10.0.3; from 11.0.0, fixed in 11.0.1; from 9.0, fixed in 9.1.2; from 10.0, fixed in 10.0.3; from 11.0.0, fixed in 11.0.1.

  • Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote…

    Affected: fixed in 8.0.2; from 9.0.0, fixed in 9.1.0; fixed in 8.0.2; from 9.0.0, fixed in 9.1.0.

  • Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and…

    Affected: fixed in 8.0.0a0.

  • Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack…

    Affected: fixed in 8.0.0a0.

  • Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard…

    Affected: fixed in 8.0.0a0.

  • Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before…

    Affected: fixed in 8.0.0a0.

  • Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before…

    Affected: from 2013.2, fixed in 2013.2.4.

  • Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect…

    Affected: all versions.

  • Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the…

    Affected: fixed in 8.0.0a0.

  • Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack…

    Affected: fixed in 8.0.0a0.