OpenStack vulnerabilities
- In CISA's KEV catalog
- 0 exploited vulnerabilities
- CVE records, last 3 years
- 77 since
Rank 212 of 467 vendors on this site - Critical or high
- 45.5% of 77 scored records; 0 not scored
Source: CISA KEV 2026.11.10, as of ; CVE List, as of . About the data.
- OpenStack has 77 CVE records published between 12 Nov 2023 and 12 Nov 2026, ranking #212 of 467 vendors on this site by that count.
- Of the 77 with a CVSS score, 35 (45.5%) are rated critical or high; 0 (0% of all) have no CVSS score.
- None of the CVE records attributed to OpenStack is listed in CISA's KEV catalog as of 12 Nov 2026.
CVE records per year, by severity
- Critical
- High
- Medium, low or none
- Not scored
* 2026 is counted through .
Show data as a table
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026* | 71 | 8 | 23 | 43.7% | 0% |
| 2025 | 2 | 0 | 1 | 50% | 0% |
| 2024 | 4 | 1 | 2 | 75% | 0% |
| 2023 | 0 | 0 | 0 | — | — |
| 2022 | 2 | 0 | 2 | 100% | 0% |
| 2021 | 0 | 0 | 0 | — | — |
| 2020 | 0 | 0 | 0 | — | — |
| 2019 | 1 | 0 | 0 | — | 100% |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 1 | 0 | 0 | — | 100% |
"Critical or high" is the share of scored records; "Not scored" is the share of all records.
Source: CVE List, as of . About the data.
OpenStack vulnerabilities not in KEV yet
Recent records that CISA has not added to KEV, with a high exploit probability (EPSS) or an early exploitation signal; see the watchlist. A probability is not a report of exploitation.
- CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns…
Source: FIRST EPSS, as of ; CVE List, as of ; CISA KEV 2026.11.10, as of . About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. The highest-scoring OpenStack records today, from 1%.
Source: FIRST EPSS, as of ; CVE List, as of ; CISA KEV 2026.11.10, as of . About the data.