CL
Product
Cloudstack
65
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 25Medium 18Low 1
Watch
Add Cloudstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-50386 | 9.9 | Nov 12 | Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances Affected: 4.0.0 before 4.18.2.5; 4.19.0.0 before 4.19.1.3 |
| CVE-2024-39864 | 9.8 | Jul 5 | The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for… Affected: 4.0.0 before 4.18.2.1; 4.19.0.0 before 4.19.0.2 |
| CVE-2024-38346 | 9.8 | Jul 5 | The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server… Affected: 4.0.0 before 4.18.2.1; 4.19.0.0 before 4.19.0.2 |
| CVE-2024-29006 | 9.8 | Apr 4 | By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request Affected: 4.11.0.0 before 4.18.1.1; 4.19.0.0 |
| CVE-2022-35741 | 9.8 | Jul 18 | Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection Affected: 4.5.0 before 4.16.1.1; 4.17.0.0 |
| CVE-2019-17562 | 9.8 | May 14 | A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack Affected: before 4.13.1.0 |
| CVE-2016-6813 | 9.8 | Feb 6 | Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API Affected: 4.1.0 through 4.8.1.0; 4.9.0 |
| CVE-2015-3252 | 9.8 | Feb 8 | Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC… Affected: through 4.5.1 |
| CVE-2026-59085 | 9.1 | Aug 21 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module Affected: 4.20.0.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 |
| CVE-2026-61398 | 9.1 | Aug 21 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI Affected: 4.15.1.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 |
| CVE-2026-62440 | 9.1 | Aug 21 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation Affected: 4.21.0.0 before 4.22.1.1 |
| CVE-2026-25199 | 9.1 | May 8 | Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access Affected: 4.21.0.0 before 4.22.0.1 |
Showing 12