https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-32498.htmlhttps://patchthecve.com/cve/CVE-2024-32498.htmlWed, 17 Jun 2026 07:29:44 +0000MEDIUM 6.5: An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to returnhttps://patchthecve.com/cve/CVE-2022-4134.htmlhttps://patchthecve.com/cve/CVE-2022-4134.htmlWed, 17 Jun 2026 05:20:02 +0000LOW 2.8: A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.https://patchthecve.com/cve/CVE-2022-25937.htmlhttps://patchthecve.com/cve/CVE-2022-25937.htmlWed, 17 Jun 2026 04:34:30 +0000MEDIUM 6.5: Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129). https://patchthecve.com/cve/CVE-2022-47951.htmlhttps://patchthecve.com/cve/CVE-2022-47951.htmlWed, 17 Jun 2026 05:14:30 +0000MEDIUM 5.7: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an ahttps://patchthecve.com/cve/CVE-2022-31546.htmlhttps://patchthecve.com/cve/CVE-2022-31546.htmlWed, 17 Jun 2026 04:45:39 +0000CRITICAL 9.3: The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.