Login Request a demo
HO
Product
Horizon
by OpenStack · last CVE Jun 17, 2026
24
CVEs
0
On KEV
6.8
Max CVSS
0
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 0High 0Medium 8Low 0
Severity
All severities24Critical0High0Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Horizon to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55748
6.8
0%
Jun 17
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters
Affected: 8.0.0 before 25.3.3; 25.4.0 before 25.5.3; 25.6.0 before 25.7.4
CVE-2022-45582
6.1
1%
Aug 22
Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter
Affected: 19.4.0 through 20.1.4
CVE-2020-29565
6.1
1%
Dec 4
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x
Affected: 15.3.0 before 15.3.2; 16.0.0 before 16.2.1; 17.0.0 before 18.3.3; 18.4.0 through 18.5.0
CVE-2012-5476
5.5
0%
Dec 30
Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value
Affected: 2012.2
CVE-2012-5474
5.5
0%
Dec 30
The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and…
Affected: 2012.1 before 2012.1.1
CVE-2016-4428
5.4
2%
Jul 12
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web…
Affected: 8.0.0 through 8.0.1; 9.0.0; 9.0.1
CVE-2026-43002
5.3
0%
May 5
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3
Affected: 25.6.0 before 25.7.3
CVE-2017-7400
4.8
1%
Apr 3
OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping
Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +13 more
Showing 8