CL
Product
Cloudstack
65
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 25Medium 18Low 1
Watch
Add Cloudstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-59454 | 4.3 | Nov 27 | In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory -… Affected: 4.0.0 before 4.20.2.0; 4.21.0.0 |
| CVE-2025-22829 | 4.3 | Jun 10 | The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0 Affected: 4.20.0.0 |
| CVE-2025-22828 | 4.3 | Jan 13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache CloudStack versions… Affected: 4.16.0.0 and later |
| CVE-2024-42222 | 4.3 | Aug 7 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts Affected: 4.19.1.0 |
| CVE-2013-4317 | 4.3 | Feb 6 | In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for… Affected: 4.1.0; 4.1.1 |
| CVE-2026-66721 | 2.7 | Aug 21 | Apache CloudStack: Authorization issue with listHostTags for domain admins Affected: 4.12.0.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 |
| CVE-2014-9593 | – | Jan 15 | Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call Affected: through 4.3.1; 4.4.0; 4.4.1 |
| CVE-2014-7807 | – | Dec 10 | Apache CloudStack 4.3.x before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to bypass authentication via a login request without a password, which triggers an… Affected: 4.3.0; 4.3.1; 4.4.0; 4.4.1 |
| CVE-2013-2758 | – | May 23 | Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predictable sequence, which makes it easier… Affected: 4.0.0; 4.0.1; 4.0.2 |
| CVE-2013-2756 | – | May 23 | Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy… Affected: 4.0.0; 4.0.1; 4.0.2 |
| CVE-2014-0031 | – | Jan 15 | The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted… Affected: through 4.2.0; 2.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +29 more |
| CVE-2013-6398 | – | Jan 15 | The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall rules after being restarted, which allows remote attackers to bypass… Affected: through 4.2.0; 2.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +29 more |
| CVE-2013-2136 | – | Aug 19 | Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network… Affected: through 4.1.0; 2.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +27 more |
| CVE-2012-5616 | – | Jan 22 | Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local… Affected: 4.0.0 |
| CVE-2012-4501 | – | Oct 26 | Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API… Affected: All versions, or not specified |