Apache Software Foundation Apache CloudStack

• CVE-2026-59654 Medium 6.8 Apache CloudStack: DoS caused by database connections leak 0.6%
• CVE-2026-47359 High 8.8 Apache CloudStack: OS Command Injection due to unsanitized mount command 2.0%
• CVE-2026-50112 High 8.8 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates 0.7%
• CVE-2026-50222 High 7.5 Apache CloudStack: Improper access control in Userdata reference APIs 0.5%
• CVE-2026-59085 Critical 9.1 Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module 0.6%
• CVE-2026-59655 High 7.5 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure 0.6%
• CVE-2026-59657 High 7.5 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob 0.3%
• CVE-2026-59780 High 7.5 Apache CloudStack: LDAP provider configuration disclosure 0.6%
• CVE-2026-59799 High 8.8 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow 0.6%
• CVE-2026-61397 High 7.5 Apache CloudStack: OAuth2 Token Cross-Request Leak 0.6%
• CVE-2026-61398 Critical 9.1 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI 0.6%
• CVE-2026-61399 Medium 4.8 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI 0.5%
• CVE-2026-61400 High 8.8 Apache CloudStack: Get and Run Diagnostics Command Injection 2.9%
• CVE-2026-61422 Medium 4.3 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate 0.4%
• CVE-2026-62440 Critical 9.1 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation 0.5%
• CVE-2026-65613 Medium 4.3 Apache CloudStack: Webhook Deliveries Incorrect Access 0.5%
• CVE-2026-66721 Low 2.7 Apache CloudStack: Authorization issue with listHostTags for domain admins 0.5%
• CVE-2026-66722 High 7.2 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue 0.6%
• CVE-2026-66797 Medium 5.4 Apache CloudStack: Unauthorised comment creation and disclosure 0.5%
• CVE-2026-68745 High 8.1 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP 0.2%
• CVE-2026-25199 Critical 9.1 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access 0.5%
• CVE-2026-25077 High 8.8 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates 0.7%
• CVE-2025-69233 Medium 6.5 Apache CloudStack: Domain/account resources limits not honored 0.4%
• CVE-2025-66467 High 8.0 Apache CloudStack: MinIO policy remains intact on bucket deletion 0.4%
• CVE-2025-66172 High 8.1 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to 0.5%
• CVE-2025-66171 Medium 6.5 Apache CloudStack: Any user can create a new VM from backups they should not have access to 0.5%
• CVE-2025-66170 Medium 6.5 Apache CloudStack: Any user can list backups that they should not have access to 0.5%
• CVE-2025-59302 Medium 4.7 Apache CloudStack: Potential remote code execution on Javascript engine defined rules 0.5%
• CVE-2025-59454 Medium 4.3 Apache CloudStack: Lack of user permission validation leading to data leak for few APIs 0.4%
• CVE-2025-30675 Medium 4.7 Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins 0.7%
• CVE-2025-22829 Low 2.3 Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin 0.9%
• CVE-2025-26521 High 8.1 Apache CloudStack: CKS cluster in project exposes user API keys 0.7%
• CVE-2025-47849 High 8.8 Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain 0.6%
• CVE-2025-47713 High 8.8 Apache CloudStack: Domain Admin can reset Admin password in Root Domain 0.6%
• CVE-2025-22828 Medium 4.3 Apache CloudStack: Unauthorised access to annotations 2.1%
• CVE-2024-50386 High 8.5 Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure 1.5%
• CVE-2024-45219 High 8.5 Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure 1.2%
• CVE-2024-45462 Medium 6.3 Apache CloudStack: Incomplete session invalidation on web interface logout 0.4%
• CVE-2024-45693 High 8.0 Apache CloudStack: Request origin validation bypass makes account takeover possible 0.5%
• CVE-2024-42062 High 7.2 Apache CloudStack: User Key Exposure to Domain Admins 0.9%
• CVE-2024-42222 Medium 4.3 Apache CloudStack: Unauthorised Network List Access 1.0%
• CVE-2024-41107 High 8.1 Apache CloudStack: SAML Signature Exclusion 17.8%
• CVE-2024-38346 Critical 9.8 Apache CloudStack: Unauthenticated cluster service port leads to remote execution 3.3%
• CVE-2024-39864 Critical 9.8 Apache CloudStack: Integration API service uses dynamic port when disabled 1.8%
• CVE-2024-29008 Medium 6.4 Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance 0.6%
• CVE-2024-29007 High 7.3 Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences 0.8%
• CVE-2024-29006 Critical 9.8 Apache CloudStack: x-forwarded-for HTTP header parsed by default 0.9%
• CVE-2022-35741 Unrated Apache CloudStack SAML Single Sign-On XXE 8.0%
• CVE-2022-26779 Unrated Apache Cloudstack insecure random number generation affects project email invitation 2.9%