CVE-2026-46448

HighCVSS 8.5/10Last modified Jun 26, 2026

Description

In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Weakness enumeration

CWE-669

Affected software

No affected versions have been published.

Timeline

Published
Jun 16, 2026
Last modified
Jun 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-464496.7The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunCVE-2026-464525.3Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward applicationCVE-2026-464535.3Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The caCVE-2026-464549.8Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message hCVE-2026-464559.8Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelperCVE-2026-464569.8Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes inCVE-2026-464577.5Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into theCVE-2026-464587.1ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. ThisCVE-2026-464595.3ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated reCVE-2026-46464.3Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API reCVE-2026-464603.5Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an IncoCVE-2026-464617.8Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with loc
CVE-2026-46448: High severity, CVSS 8.5 | Vulnix