# nova (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/pypi-nova  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pypi-nova.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 55 vulnerabilities in nova (PyPI): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2024-32498, was published on 13 July 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 55 (0 critical, 0 exploited in the wild)

## About nova (PyPI)

OpenStack project for providing compute virtualization and cloud infrastructure services.

## Latest nova (PyPI) vulnerabilities

- [CVE-2024-32498: PYSEC-2026-2493 - OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access](https://junglewise.ai/threats/cve-2024-32498-openstack-cinder-glance-and-nova-vulnerable-to-arbitrary-file) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2024-40767: PYSEC-2026-1709 - OpenStack Nova vulnerable to unauthorized access to potentially sensitive data](https://junglewise.ai/threats/cve-2024-40767-openstack-nova-vulnerable-to-unauthorized-access-to-potentially) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2022-47951: PYSEC-2026-868 - OpenStack Cinder, glance, and Nova vulnerable to Path Traversal](https://junglewise.ai/threats/cve-2022-47951-openstack-cinder-glance-and-nova-vulnerable-to-path-traversal) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2022-37394: PYSEC-2026-882 - OpenStack Nova Changing vnic_type breaks compute service restart](https://junglewise.ai/threats/cve-2022-37394-openstack-nova-changing-vnic-type-breaks-compute-service-restart) (low, CVSS 3.1, published 6 Jul 2026)
- [CVE-2015-9543: PYSEC-2026-857 - OpenStack Nova can leak consoleauth token into log files](https://junglewise.ai/threats/cve-2015-9543-openstack-nova-consoleauth-token-leak-into-log-files) (low, CVSS 3.1, published 6 Jul 2026)
- [CVE-2013-4278: PYSEC-2026-862 - OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors](https://junglewise.ai/threats/cve-2013-4278-openstack-compute-nova-resource-limit-circumvention-in-nova) (info, published 6 Jul 2026)
- [CVE-2013-4179: PYSEC-2026-875 - OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack](https://junglewise.ai/threats/cve-2013-4179-openstack-compute-nova-vulnerable-to-denial-of-service-via-xml) (info, published 6 Jul 2026)
- [CVE-2013-4497: PYSEC-2026-859 - OpenStack Compute Nova Improper Access Control](https://junglewise.ai/threats/cve-2013-4497-openstack-compute-nova-improper-access-control-in-xenapi-backend) (info, published 6 Jul 2026)
- [CVE-2013-2096: PYSEC-2026-876 - OpenStack Compute (Nova) does not verify the virtual size of a QCOW2 image](https://junglewise.ai/threats/cve-2013-2096-openstack-compute-nova-does-not-verify-the-virtual-size-of-a-qcow2) (medium, CVSS 4, published 6 Jul 2026)
- [CVE-2013-6419: PYSEC-2026-858 - OpenStack Nova Router metadata queries are not restricted by tenant](https://junglewise.ai/threats/cve-2013-6419-openstack-nova-metadata-queries-tenant-isolation-bypass) (info, CVSS 0, published 6 Jul 2026)
- [CVE-2013-4463: PYSEC-2026-865 - OpenStack Nova denial of service through compressed disk images](https://junglewise.ai/threats/cve-2013-4463-openstack-nova-denial-of-service-through-compressed-disk-images) (info, published 6 Jul 2026)
- [CVE-2014-0167: PYSEC-2026-878 - OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests](https://junglewise.ai/threats/cve-2014-0167-openstack-compute-nova-allows-remote-authenticated-users-to-gain) (medium, CVSS 4, published 6 Jul 2026)
- [CVE-2013-4469: PYSEC-2026-860 - OpenStack Compute (Nova) Denial of service due to improper validation of virtual size of QCOW2 image](https://junglewise.ai/threats/cve-2013-4469-openstack-nova-denial-of-service-in-qcow2-image-validation) (info, CVSS 0, published 6 Jul 2026)
- [CVE-2015-5162: PYSEC-2026-871 - OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption](https://junglewise.ai/threats/cve-2015-5162-openstack-cinder-glance-and-nova-contain-uncontrolled-resource) (low, CVSS 3, published 6 Jul 2026)
- [CVE-2012-1585: PYSEC-2026-880 - OpenStack Nova Long server names grow nova-api log files significantly](https://junglewise.ai/threats/cve-2012-1585-openstack-nova-long-server-names-grow-nova-api-log-files) (info, published 6 Jul 2026)
- [CVE-2013-4185: PYSEC-2026-879 - OpenStack Nova Denial of Service in network source security groups](https://junglewise.ai/threats/cve-2013-4185-openstack-nova-denial-of-service-in-network-source-security-groups) (info, published 6 Jul 2026)
- [CVE-2014-3517: PYSEC-2026-884 - OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability](https://junglewise.ai/threats/cve-2014-3517-openstack-compute-nova-exposure-of-sensitive-information-to-an) (info, published 6 Jul 2026)
- [CVE-2011-4596: PYSEC-2026-881 - OpenStack Nova Multiple directory traversal vulnerabilities](https://junglewise.ai/threats/cve-2011-4596-openstack-nova-multiple-directory-traversal-vulnerabilities) (info, published 6 Jul 2026)
- [CVE-2013-2256: PYSEC-2026-866 - OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information](https://junglewise.ai/threats/cve-2013-2256-openstack-compute-nova-allows-remote-authenticated-users-to-obtain) (info, published 6 Jul 2026)
- [CVE-2015-8749: PYSEC-2026-870 - OpenStack Nova Potential Xen connection password leak via StorageError](https://junglewise.ai/threats/cve-2015-8749-openstack-nova-potential-xen-connection-password-leak-via) (low, CVSS 3, published 6 Jul 2026)
- [CVE-2013-6437: PYSEC-2026-874 - OpenStack Nova DoS through ephemeral disk backing files](https://junglewise.ai/threats/cve-2013-6437-openstack-nova-dos-through-ephemeral-disk-backing-files) (info, published 6 Jul 2026)
- [CVE-2015-3241: PYSEC-2026-861 - OpenStack Nova instance migration process does not stop when instance is deleted](https://junglewise.ai/threats/cve-2015-3241-openstack-nova-instance-migration-process-does-not-stop-when) (info, published 6 Jul 2026)
- [CVE-2015-7713: PYSEC-2026-867 - OpenStack Compute (Nova) allows remote attackers to bypass intended restriction](https://junglewise.ai/threats/cve-2015-7713-openstack-compute-nova-allows-remote-attackers-to-bypass-intended) (info, published 6 Jul 2026)
- [CVE-2014-3708: PYSEC-2026-863 - OpenStack Compute (Nova) Denial of Service vulnerability](https://junglewise.ai/threats/cve-2014-3708-openstack-compute-nova-denial-of-service-vulnerability) (info, published 6 Jul 2026)
- [CVE-2014-3608: PYSEC-2026-869 - OpenStack Compute (Nova)'s VMWare driver vulnerable to denial of service](https://junglewise.ai/threats/cve-2014-3608-openstack-compute-nova-s-vmware-driver-vulnerable-to-denial-of) (info, published 6 Jul 2026)

## Most severe nova (PyPI) vulnerabilities

- [CVE-2026-24708: OpenStack Nova host data destruction via unsafe qemu-img resize](https://junglewise.ai/threats/cve-2026-24708-openstack-nova-host-data-destruction-via-unsafe-qemu-img-resize) (high, CVSS 8.2, published 18 Feb 2026)
- [CVE-2026-46448: OpenStack Nova scheduler hint injection in server create API](https://junglewise.ai/threats/cve-2026-46448-openstack-nova-scheduler-hint-injection-in-server-create-api) (medium, CVSS 5.4, published 16 Jun 2026)
- [CVE-2012-5625: OpenStack Nova information leak in libvirt LVM-backed instances](https://junglewise.ai/threats/cve-2012-5625-openstack-nova-information-leak-in-libvirt-lvm-backed-instances) (medium, CVSS 4.3, published 17 May 2022)
- [CVE-2014-0167: PYSEC-2026-878 - OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests](https://junglewise.ai/threats/cve-2014-0167-openstack-compute-nova-allows-remote-authenticated-users-to-gain) (medium, CVSS 4, published 6 Jul 2026)
- [CVE-2013-2096: PYSEC-2026-876 - OpenStack Compute (Nova) does not verify the virtual size of a QCOW2 image](https://junglewise.ai/threats/cve-2013-2096-openstack-compute-nova-does-not-verify-the-virtual-size-of-a-qcow2) (medium, CVSS 4, published 6 Jul 2026)
- [CVE-2021-3654: PYSEC-2026-693 - Open Redirect in CPython that affects users of OpenStack Nova](https://junglewise.ai/threats/cve-2021-3654-open-redirect-in-cpython-that-affects-users-of-openstack-nova) (low, CVSS 3.1, published 2 Jul 2026)
- [CVE-2013-1838: OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function](https://junglewise.ai/threats/cve-2013-1838-openstack-compute-nova-denial-of-service-via-a-large-number-of) (low, CVSS 3.1, published 22 Mar 2013)
- [CVE-2013-7130: OpenStack Nova Live migration can leak root disk into ephemeral storage](https://junglewise.ai/threats/cve-2013-7130-openstack-nova-live-migration-can-leak-root-disk-into-ephemeral) (low, CVSS 3.1, published 6 Feb 2014)
- [CVE-2013-0335: OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM](https://junglewise.ai/threats/cve-2013-0335-openstack-compute-nova-unauthorised-access-to-arbitrary-vm-using) (low, CVSS 3.1, published 22 Mar 2013)
- [CVE-2019-14433: OpenStack Nova Server Resource Faults Leak External Exception Details](https://junglewise.ai/threats/cve-2019-14433-openstack-nova-server-resource-faults-leak-external-exception) (low, CVSS 3.1, published 9 Aug 2019)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "nova (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pypi-nova, 13 November 2026.