# horizon (PyPI) vulnerabilities 14 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pypi.org/project/horizon/ ## Advisories (14) ### [CVE-2026-55748](https://cve.now/CVE-2026-55748): OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell… - Severity: Medium 6.0 - Published: Jun 17, 2026 - Affected: through 25.7.3. ### [CVE-2026-43002](https://cve.now/CVE-2026-43002): An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. - Severity: Medium 5.3 - Published: May 5, 2026 - Affected: from 25.6, fixed in 25.7.3. ### [CVE-2022-45582](https://cve.now/CVE-2022-45582): Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success\_url parameter. - Severity: Unrated - Published: Aug 22, 2023 - Affected: from 19.4.0, fixed in 20.2.0. ### [CVE-2020-29565](https://cve.now/CVE-2020-29565): An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. - Severity: Unrated - Published: Dec 4, 2020 - Affected: from 15.3.0, fixed in 15.3.2; from 16.0.0, fixed in 16.2.1; from 17.0.0, fixed in 18.3.3; from 18.4.0, fixed in 18.6.0; fixed in 15.3.2; from 16.0.0, fixed in 16.2.1; from 17.0.0, fixed in 18.3.3; from 18.4.0, fixed in 18.6.0. ### [CVE-2017-7400](https://cve.now/CVE-2017-7400): OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via… - Severity: Unrated - Published: Apr 3, 2017 - Affected: from 9.0, fixed in 9.1.2; from 10.0, fixed in 10.0.3; from 11.0.0, fixed in 11.0.1; from 9.0, fixed in 9.1.2; from 10.0, fixed in 10.0.3; from 11.0.0, fixed in 11.0.1. ### [CVE-2016-4428](https://cve.now/CVE-2016-4428): Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote… - Severity: Unrated - Published: Jul 12, 2016 - Affected: fixed in 8.0.2; from 9.0.0, fixed in 9.1.0; fixed in 8.0.2; from 9.0.0, fixed in 9.1.0. ### [CVE-2015-3219](https://cve.now/CVE-2015-3219): Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and… - Severity: Unrated - Published: Aug 20, 2015 - Affected: fixed in 8.0.0a0. ### [CVE-2014-3474](https://cve.now/CVE-2014-3474): Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack… - Severity: Unrated - Published: Oct 31, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-3473](https://cve.now/CVE-2014-3473): Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard… - Severity: Unrated - Published: Oct 31, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-3594](https://cve.now/CVE-2014-3594): Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before… - Severity: Unrated - Published: Aug 22, 2014 - Affected: fixed in 8.0.0a0. ### [CVE-2014-0157](https://cve.now/CVE-2014-0157): Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before… - Severity: Unrated - Published: Apr 15, 2014 - Affected: from 2013.2, fixed in 2013.2.4. ### [CVE-2012-3540](https://cve.now/CVE-2012-3540): Open redirect vulnerability in views/auth\_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect… - Severity: Unrated - Published: Sep 5, 2012 - Affected: all versions. ### [CVE-2012-2144](https://cve.now/CVE-2012-2144): Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the… - Severity: Unrated - Published: Jun 5, 2012 - Affected: fixed in 8.0.0a0. ### [CVE-2012-2094](https://cve.now/CVE-2012-2094): Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack… - Severity: Unrated - Published: Jun 5, 2012 - Affected: fixed in 8.0.0a0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/horizon Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.