CVE WatchJul 15, 2026

CVE-2026-50589

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or J

CVSS

5.3

Medium

EPSS

0.4%

p35

KEV

—

Exploit Today

0-100

Published: Jun 5, 2026 · Last modified: Jul 15, 2026 · CWE-770 · CWE-502

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-06-302026-07-18

Technical description

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-422379.8 CRI

99.9%

KEV—80Sitecore XP Remote Command Execution Vulnerability10d CVE-2026-456598.8 HIG

86.8%

KEV—76Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability17d CVE-2026-586449.8 CRI

70.7%

KEV—71Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2d CVE-2026-125699.8 CRI

66.0%

KEV—70PTC Windchill and FlexPLM Improper Input Validation Vulnerability19d CVE-2026-217107.5 HIG

97.8%

——29A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**4d CVE-2026-505229.8 CRI

97.2%

——29Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.4d