AC
Product
Apache CloudStack
27
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 4High 15Medium 7Low 1
Watch
Add Apache CloudStack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47359 | 8.8 | Aug 21 | Apache CloudStack: OS Command Injection due to unsanitized mount command Affected: 4.20.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-50112 | 8.8 | Aug 21 | Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates Affected: 4.14.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59799 | 8.8 | Aug 21 | Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow Affected: 4.18.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-61400 | 8.8 | Aug 21 | Apache CloudStack: Get and Run Diagnostics Command Injection Affected: 4.14.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-25077 | 8.8 | May 8 | Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates Affected: 4.11.0 through 4.20.2.0; 4.21.0.0 through 4.22.0.0 |
| CVE-2026-68745 | 8.1 | Aug 21 | Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP Affected: 4.5.2 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2025-66467 | 8.1 | May 8 | Apache CloudStack: MinIO policy remains intact on bucket deletion Affected: 4.19.0.0 through 4.20.2.0; 4.21.0.0 through 4.22.0.0 |
| CVE-2025-66172 | 8.1 | May 8 | Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to Affected: 4.21.0.0 through 4.22.0.0 |
| CVE-2026-59654 | 7.5 | Aug 21 | Apache CloudStack: DoS caused by database connections leak Affected: 4.7.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-50222 | 7.5 | Aug 21 | Apache CloudStack: Improper access control in Userdata reference APIs Affected: 4.18.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59655 | 7.5 | Aug 21 | Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure Affected: 4.19.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59657 | 7.5 | Aug 21 | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob Affected: 4.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-59780 | 7.5 | Aug 21 | Apache CloudStack: LDAP provider configuration disclosure Affected: 4.2.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-61397 | 7.5 | Aug 21 | Apache CloudStack: OAuth2 Token Cross-Request Leak Affected: 4.19.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
| CVE-2026-66722 | 7.2 | Aug 21 | Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue Affected: 4.15.0.0 through 4.20.3.0; 4.21.0.0 through 4.22.1.0 |
Showing 15