AC
Product
Apache CloudStack
27
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 4High 15Medium 7Low 1
Watch
Add Apache CloudStack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59085 | 9.1 | Aug 21 | Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module Affected: 4.20.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-61398 | 9.1 | Aug 21 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI Affected: 4.15.1.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-62440 | 9.1 | Aug 21 | Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation Affected: 4.21.0.0 through 4.22.1.0 |
| CVE-2026-25199 | 9.1 | May 8 | Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access Affected: 4.21.0 through 4.22.0 |
| CVE-2026-47359 | 8.8 | Aug 21 | Apache CloudStack: OS Command Injection due to unsanitized mount command Affected: 4.20.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-50112 | 8.8 | Aug 21 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates Affected: 4.14.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59799 | 8.8 | Aug 21 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow Affected: 4.18.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-61400 | 8.8 | Aug 21 | Apache CloudStack: Get and Run Diagnostics Command Injection Affected: 4.14.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-25077 | 8.8 | May 8 | Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates Affected: 4.11.0 through 4.20.2.0; 4.21.0.0 through 4.22.0.0 |
| CVE-2026-68745 | 8.1 | Aug 21 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP Affected: 4.5.2 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2025-66467 | 8.1 | May 8 | Apache CloudStack: MinIO policy remains intact on bucket deletion Affected: 4.19.0.0 through 4.20.2.0; 4.21.0.0 through 4.22.0.0 |
| CVE-2025-66172 | 8.1 | May 8 | Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to Affected: 4.21.0.0 through 4.22.0.0 |
| CVE-2026-59654 | 7.5 | Aug 21 | Apache CloudStack: DoS caused by database connections leak Affected: 4.7.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-50222 | 7.5 | Aug 21 | Apache CloudStack: Improper access control in Userdata reference APIs Affected: 4.18.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59655 | 7.5 | Aug 21 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure Affected: 4.19.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59657 | 7.5 | Aug 21 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob Affected: 4.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59780 | 7.5 | Aug 21 | Apache CloudStack: LDAP provider configuration disclosure Affected: 4.2.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-61397 | 7.5 | Aug 21 | Apache CloudStack: OAuth2 Token Cross-Request Leak Affected: 4.19.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-66722 | 7.2 | Aug 21 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue Affected: 4.15.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2025-66171 | 6.5 | May 8 | Apache CloudStack: Any user can create a new VM from backups they should not have access to Affected: 4.21.0.0 through 4.22.0.0 |
| CVE-2025-66170 | 6.5 | May 8 | Apache CloudStack: Any user can list backups that they should not have access to Affected: 4.21.0.0 through 4.22.0.0 |
| CVE-2026-66797 | 5.4 | Aug 21 | Apache CloudStack: Unauthorised comment creation and disclosure Affected: 4.16.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2025-69233 | 5.3 | May 8 | Apache CloudStack: Domain/account resources limits not honored Affected: 4.0.0 through 4.20.2.0; 4.21.0.0 through 4.22.0.0 |
| CVE-2026-61399 | 4.8 | Aug 21 | Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI Affected: 4.20.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-61422 | 4.3 | Aug 21 | Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate Affected: 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-65613 | 4.3 | Aug 21 | Apache CloudStack: Webhook Deliveries Incorrect Access Affected: 4.20.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-66721 | 2.7 | Aug 21 | Apache CloudStack: Authorization issue with listHostTags for domain admins Affected: 4.12.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
Showing 27