Openstack Cloud

Vendor:

First CVE: Mar 9, 2016 · Active for 10 years

35
Total CVEs
More Total CVEs than 96% of tracked products
5.8
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
6.9
Avg CVSS
Higher Avg CVSS than 40% of tracked products
11.4%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Openstack Cloud over time

Volume of CVEsAvg CVSS Base Score
First CVE
Mar 9, 2016
10 years ago
Most Recent CVE
Apr 22, 2026
93 days ago

CVE Severity & Scoring

Openstack Cloud35 CVEs
All CVEs352,231 CVEs
LowMediumHighCritical
Attack Vector
Local9 (25.7%)
Network16 (45.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network10 (28.6%)
Attack Complexity
Low23 (65.7%)
High12 (34.3%)
Unknown0 (0.0%)
User Interaction
None33 (94.3%)
Unknown0 (0.0%)
Required2 (5.7%)
Privileges Required
Low8 (22.9%)
High0 (0.0%)
None27 (77.1%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (35 CVEs).

35 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the c
Apr 22, 20267.899YESYES
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai
Apr 21, 20169.895YESNO
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted ima
May 5, 20165.593YESYES
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
May 5, 20165.593YESYES
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-a
Jan 3, 20189.860NONO
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature r
Mar 9, 20168.656NONO
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a
Mar 9, 20166.856NONO
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix
Jul 5, 20167.549NONO
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow
Apr 8, 20169.842NONO
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leadin
Apr 8, 20169.841NONO

Exploit Exposure

Signals from CVEs in this product scope (35 CVEs).

CISA KEV
4 CVEs
11.4% of CVEs· 97th percentile
Metasploit
1 CVE
2.9% of CVEs· 96th percentile
Nuclei
1 CVE
2.9% of CVEs· 96th percentile
ExploitDB
2 CVEs
5.7% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (35 CVEs).

Media Mentions

Signals from CVEs in this product scope (35 CVEs).

Top CNAs Publishing CVEs For Openstack Cloud

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
9.037.832.4%11
8.038.10.6%00
7.017.80.3%00
6126.16.4%00
5177.131.1%32