openstack nova

Name: openstack nova
Brand: openstack

productUS

cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

by severity

1critical6high24medium8low

updated 2026-10-28

vulnerabilities (39)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-3654US	medium6.1	26.8% (98th)	—	21.2.3	2022-03-02	3 versions
CVE-2017-18191US	high7.5	3.72% (90th)	—	no fix	2018-02-19	2 versions
CVE-2015-7713US	medium5.0	3.70% (90th)	—	2014.2.4	2015-10-29	2 versions
CVE-2015-3241US	medium6.8	3.48% (89th)	—	no fix	2015-09-08	2 versions
CVE-2015-3280US	medium6.8	3.38% (89th)	—	2015.1.2	2015-10-26	2 versions
CVE-2015-5162US	high7.5	3.09% (88th)	—	no fix	2016-10-07	2 versions
CVE-2014-3708US	medium4.0	2.81% (86th)	—	2014.1.4	2014-10-31	2 versions
CVE-2017-7214US	critical9.8	2.30% (83rd)	—	no fix	2017-03-21	12 versions
CVE-2015-8749US	medium5.9	2.24% (83rd)	—	2015.1.3	2016-01-15	2 versions
CVE-2016-2140US	medium5.3	2.11% (82nd)	—	12.0.3	2016-04-12	2 versions
CVE-2012-1585US	medium4.0	2.09% (82nd)	—	2011.3	2012-08-17	2011.1 → 2011.3
CVE-2013-6437US	medium4.0	2.04% (81st)	—	2013.1.5	2014-03-06	3 versions
CVE-2014-8750US	medium6.5	2.03% (81st)	—	2014.1.4	2014-10-15	2 versions
CVE-2014-8333US	medium4.0	2.02% (81st)	—	2014.1.4	2014-10-31	2014.1 → 2014.1.4
CVE-2017-17051US	high8.6	1.99% (81st)	—	no fix	2017-12-05	= 16.0.3
CVE-2014-3517US	medium4.3	1.95% (80th)	—	2014.1.2	2014-08-07	3 versions
CVE-2019-14433US	medium6.5	1.94% (80th)	—	17.0.12	2019-08-09	3 versions
CVE-2012-3447US	medium4.9OT elevated	1.93% (80th)	—	no fix	2012-08-20	= 2012.1
CVE-2013-2256US	medium6.0	1.84% (79th)	—	2013.1.3	2013-09-16	2 versions
CVE-2015-7548US	low3.5	1.80% (78th)	—	12.0.1	2016-01-12	2 versions
CVE-2011-4596US	medium6.0	1.76% (78th)	—	2011.3.1	2011-12-23	2011.3 → 2011.3.1
CVE-2020-17376US	high8.3	1.73% (78th)	—	19.3.1	2020-08-26	3 versions
CVE-2014-3608US	low2.7	1.73% (77th)	—	2014.1.3	2014-10-06	2 versions
CVE-2012-0030US	medium4.9	1.69% (77th)	—	no fix	2012-01-13	= 2011.3
CVE-2012-2101US	low3.5	1.46% (74th)	—	no fix	2012-06-07	3 versions
CVE-2011-4076US	medium5.9	1.46% (73rd)	—	2012.1	2019-11-26	2010.1 → 2012.1
CVE-2017-16239US	medium6.5	1.42% (73rd)	—	no fix	2017-11-14	12 versions
CVE-2015-0259US	medium5.1OT elevated	1.07% (65th)	—	2014.2.3	2015-04-01	3 versions
CVE-2022-47951US	medium5.7	1.03% (64th)	—	24.1.2	2023-01-26	2 versions
CVE-2024-40767US	medium6.5	0.95% (61st)	—	29.1.1	2024-07-24	3 versions
CVE-2024-32498US	medium6.5	0.83% (58th)	—	29.0.3	2024-07-05	3 versions
CVE-2011-3147US	high8.6	0.74% (54th)	—	2012.1	2019-04-22	2010.1 → 2012.1
CVE-2014-7231US	low2.1	0.53% (45th)	—	2014.1.3	2014-10-08	2 versions
CVE-2014-7230US	low2.1	0.49% (42nd)	—	2013.2.4	2014-10-08	2 versions
CVE-2013-7048US	low3.3	0.48% (41st)	—	no fix	2014-01-23	2 versions
CVE-2015-9543US	low3.3	0.41% (35th)	—	18.2.4	2020-02-19	3 versions
CVE-2013-0326US	medium5.5	0.36% (29th)	—	no fix	2019-12-05	—
CVE-2022-37394US	low3.3	0.31% (24th)	—	24.1.2	2022-08-03	3 versions
CVE-2026-46448US	high8.5	0.27% (20th)	—	32.2.1	2026-06-16	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor11 CVEs
CWE-399CWE-3998 CVEs
CWE-264CWE-2645 CVEs
CWE-400Uncontrolled Resource Consumption4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-552Files or Directories Accessible to External Parties3 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-254CWE-2541 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE39 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan