CL
Product
Cloudstack
65
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 12High 25Medium 18Low 1
Watch
Add Cloudstack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-66171 | 6.5 | May 8 | Apache CloudStack: Any user can create a new VM from backups they should not have access to Affected: 4.21.0.0 before 4.22.0.1 |
| CVE-2025-66170 | 6.5 | May 8 | Apache CloudStack: Any user can list backups that they should not have access to Affected: 4.21.0.0 before 4.22.0.1 |
| CVE-2016-3085 | 6.5 | Jun 10 | Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote… Affected: 4.7.0; 4.5.1; 4.5.2; 4.6.0; 4.6.1; 4.6.2; +1 more |
| CVE-2024-29008 | 6.4 | Apr 4 | A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or… Affected: 4.14.0.0 before 4.18.1.1; 4.19.0.0 |
| CVE-2024-45461 | 6.3 | Oct 16 | The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default Affected: 4.7.0 before 4.18.2.4; 4.19.0.0 before 4.19.1.2 |
| CVE-2026-66797 | 5.4 | Aug 21 | Apache CloudStack: Unauthorised comment creation and disclosure Affected: 4.15.0.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 |
| CVE-2025-69233 | 5.3 | May 8 | Apache CloudStack: Domain/account resources limits not honored Affected: 4.0.0 before 4.20.3.0; 4.21.0.0 before 4.22.0.1 |
| CVE-2015-3251 | 4.9 | Feb 8 | Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified… Affected: 4.4.4; 4.5.1 |
| CVE-2026-61399 | 4.8 | Aug 21 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI Affected: 4.20.0.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 |
| CVE-2025-59302 | 4.7 | Nov 27 | In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins Affected: 4.18.0.0 before 4.20.2.0; 4.21.0.0 |
| CVE-2025-30675 | 4.7 | Jun 11 | In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs Affected: 4.0.0 before 4.19.3.0; 4.20.0.0 before 4.20.1.0 |
| CVE-2026-61422 | 4.3 | Aug 21 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate Affected: 4.21.0.0 before 4.22.1.1; 4.20.3.0 |
| CVE-2026-65613 | 4.3 | Aug 21 | Apache CloudStack: Webhook Deliveries Incorrect Access Affected: 4.20.0.0 before 4.20.3.1; 4.21.0.0 before 4.22.1.1 |
| CVE-2025-59454 | 4.3 | Nov 27 | In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory -… Affected: 4.0.0 before 4.20.2.0; 4.21.0.0 |
| CVE-2025-22829 | 4.3 | Jun 10 | The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0 Affected: 4.20.0.0 |
| CVE-2025-22828 | 4.3 | Jan 13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache CloudStack versions… Affected: 4.16.0.0 and later |
| CVE-2024-42222 | 4.3 | Aug 7 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts Affected: 4.19.1.0 |
| CVE-2013-4317 | 4.3 | Feb 6 | In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for… Affected: 4.1.0; 4.1.1 |
Showing 18