Apache Cloudstack vulnerabilities

• apache cloudstack Apache CloudStack: DoS caused by database connections leak CVE-2026-59654 6.8 MediumAugust 21, 2026
• apache cloudstack Apache CloudStack: OS Command Injection due to unsanitized mount command CVE-2026-47359 8.8 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates CVE-2026-50112 8.8 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Improper access control in Userdata reference APIs CVE-2026-50222 7.5 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module CVE-2026-59085 9.1 CriticalAugust 21, 2026
• apache cloudstack Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure CVE-2026-59655 7.5 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob CVE-2026-59657 7.5 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: LDAP provider configuration disclosure CVE-2026-59780 7.5 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow CVE-2026-59799 8.8 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: OAuth2 Token Cross-Request Leak CVE-2026-61397 7.5 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI CVE-2026-61398 9.1 CriticalAugust 21, 2026
• apache cloudstack Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI CVE-2026-61399 4.8 MediumAugust 21, 2026
• apache cloudstack Apache CloudStack: Get and Run Diagnostics Command Injection CVE-2026-61400 8.8 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate CVE-2026-61422 4.3 MediumAugust 21, 2026
• apache cloudstack Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation CVE-2026-62440 9.1 CriticalAugust 21, 2026
• apache cloudstack Apache CloudStack: Webhook Deliveries Incorrect Access CVE-2026-65613 4.3 MediumAugust 21, 2026
• apache cloudstack Apache CloudStack: Authorization issue with listHostTags for domain admins CVE-2026-66721 2.7 LowAugust 21, 2026
• apache cloudstack Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue CVE-2026-66722 7.2 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Unauthorised comment creation and disclosure CVE-2026-66797 5.4 MediumAugust 21, 2026
• apache cloudstack Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP CVE-2026-68745 8.1 HighAugust 21, 2026
• apache cloudstack Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access CVE-2026-25199 9.1 CriticalMay 8, 2026
• apache cloudstack Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates CVE-2026-25077 8.8 HighMay 8, 2026
• apache cloudstack Apache CloudStack: Domain/account resources limits not honored CVE-2025-69233 6.5 MediumMay 8, 2026
• apache cloudstack Apache CloudStack: MinIO policy remains intact on bucket deletion CVE-2025-66467 8.0 HighMay 8, 2026
• apache cloudstack Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to CVE-2025-66172 8.1 HighMay 8, 2026
• apache cloudstack Apache CloudStack: Any user can create a new VM from backups they should not have access to CVE-2025-66171 6.5 MediumMay 8, 2026
• apache cloudstack Apache CloudStack: Any user can list backups that they should not have access to CVE-2025-66170 6.5 MediumMay 8, 2026
• apache cloudstack Apache CloudStack: Potential remote code execution on Javascript engine defined rules CVE-2025-59302 4.7 MediumNovember 27, 2025
• apache cloudstack Apache CloudStack: Lack of user permission validation leading to data leak for few APIs CVE-2025-59454 4.3 MediumNovember 27, 2025
• apache cloudstack Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins CVE-2025-30675 4.7 MediumJune 10, 2025
• apache cloudstack Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin CVE-2025-22829 2.3 LowJune 10, 2025
• apache cloudstack Apache CloudStack: CKS cluster in project exposes user API keys CVE-2025-26521 8.1 HighJune 10, 2025
• apache cloudstack Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain CVE-2025-47849 8.8 HighJune 10, 2025
• apache cloudstack Apache CloudStack: Domain Admin can reset Admin password in Root Domain CVE-2025-47713 8.8 HighJune 10, 2025
• apache cloudstack Apache CloudStack: Unauthorised access to annotations CVE-2025-22828 Public exploit 4.3 MediumJanuary 13, 2025
• apache cloudstack Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure CVE-2024-50386 8.5 HighNovember 12, 2024
• apache cloudstack Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure CVE-2024-45219 8.5 HighOctober 16, 2024
• apache cloudstack, apache software foundation cloudstack quota plugin +1 more Apache CloudStack Quota plugin: Access checks not enforced in Quota CVE-2024-45461 5.7 MediumOctober 16, 2024
• apache cloudstack Apache CloudStack: Incomplete session invalidation on web interface logout CVE-2024-45462 6.3 MediumOctober 16, 2024
• apache cloudstack Apache CloudStack: Request origin validation bypass makes account takeover possible CVE-2024-45693 8.0 HighOctober 16, 2024
• apache cloudstack Apache CloudStack: User Key Exposure to Domain Admins CVE-2024-42062 7.2 HighAugust 7, 2024
• apache cloudstack Apache CloudStack: Unauthorised Network List Access CVE-2024-42222 4.3 MediumAugust 7, 2024
• apache cloudstack Apache CloudStack: SAML Signature Exclusion CVE-2024-41107 Public exploit EPSS 17.8% 8.1 HighJuly 19, 2024
• apache cloudstack Apache CloudStack: Unauthenticated cluster service port leads to remote execution CVE-2024-38346 9.8 CriticalJuly 5, 2024
• apache cloudstack Apache CloudStack: Integration API service uses dynamic port when disabled CVE-2024-39864 9.8 CriticalJuly 5, 2024
• apache cloudstack Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance CVE-2024-29008 6.4 MediumApril 4, 2024
• apache cloudstack Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences CVE-2024-29007 7.3 HighApril 4, 2024
• apache cloudstack Apache CloudStack: x-forwarded-for HTTP header parsed by default CVE-2024-29006 9.8 CriticalApril 4, 2024
• apache cloudstack Apache CloudStack SAML Single Sign-On XXE CVE-2022-35741 9.8 CriticalJuly 18, 2022
• apache cloudstack Apache Cloudstack insecure random number generation affects project email invitation CVE-2022-26779 7.5 HighMarch 15, 2022
• Show olderLoading…