Login Request a demo
CF
Vendor
Cloud Foundry
15 products with CVEs on record
27
CVEs
0
On KEV
4
New 30D
Products
CF
cf-deployment
Cloud Foundry
9.0
4 CVEs0 on KEV2 new
UA
UAA
Cloud Foundry
9.0
4 CVEs0 on KEV2 new
BO
Bosh
Cloud Foundry
8.8
5 CVEs0 on KEV0 new
CF
Cloud Foundry Container Runtime (CFCR)
Cloud Foundry
8.8
2 CVEs0 on KEV0 new
ST
Stratos
Cloud Foundry
8.8
2 CVEs0 on KEV0 new
BS
Bits Service
Cloud Foundry
6.8
1 CVEs0 on KEV0 new
BS
Bosh System Metrics Server
Cloud Foundry
6.5
1 CVEs0 on KEV0 new
BO
bosh-vsphere-cpi-release
Cloud Foundry
7.7
1 CVEs0 on KEV0 new
CA
CAPI
Cloud Foundry
8.1
1 CVEs0 on KEV0 new
CC
CF CLI
Cloud Foundry
8.8
1 CVEs0 on KEV0 new
CF
Cf-networking
Cloud Foundry
8.8
1 CVEs0 on KEV0 new
CC
CredHub CLI
Cloud Foundry
7.8
1 CVEs0 on KEV0 new
DI
Diego
Cloud Foundry
7.5
1 CVEs0 on KEV0 new
UR
UAA Release (OSS)
Cloud Foundry
6.5
1 CVEs0 on KEV0 new
UU
UUA
Cloud Foundry
8.6
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-59357
CF
cf-deployment
Cloud Foundry
6.5
0%
Oct 6Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
CVE-2026-59358
UA
UAA
Cloud Foundry
7.6
0%
Oct 6UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
CVE-2026-41012
BO
bosh-vsphere-cpi-release
Cloud Foundry
7.7
0%
Aug 29BOSH vSphere CPI Improper Cert Validation
CVE-2026-59335
UA
UAA
Cloud Foundry
8.7
1%
Aug 25Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
CVE-2026-41005
CD
CF Deployment
Cloud Foundry
9.0
0%
Jun 11UAA accepts SAML Encrypted Assertions authentication bypass
CVE-2026-41704
BO
Bosh
Cloud Foundry
5.0
0%
May 27Compromised VM can make arbitrary blobstore deletes
CVE-2026-41009
BO
Bosh
Cloud Foundry
5.8
0%
May 27Local Blobstore may allow arbitrary reads/deletes
CVE-2026-22734
UU
UUA
Cloud Foundry
8.6
0%
Apr 16Cloud Foundry UAA SAML 2.0 Signature Bypass
CVE-2020-5422
BS
Bosh System Metrics Server
Cloud Foundry
6.5
1%
Oct 2BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director
CVE-2019-11271
BO
Bosh
Cloud Foundry
7.8
0%
Jun 19Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database
CVE-2019-3785
CA
CAPI
Cloud Foundry
8.1
1%
Mar 13Cloud Controller provides signed URL with write authorization to read only user
CVE-2019-3780
CF
Cloud Foundry Container Runtime (CFCR)
Cloud Foundry
8.8
1%
Mar 8Cloud Foundry Container Runtime Leaks IAAS Credentials
CVE-2019-3779
CF
Cloud Foundry Container Runtime (CFCR)
Cloud Foundry
8.8
1%
Mar 8Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD
CVE-2019-3784
ST
Stratos
Cloud Foundry
6.5
1%
Mar 7Cloud Foundry Stratos contains a Session Collision Vulnerability
CVE-2019-3783
ST
Stratos
Cloud Foundry
8.8
1%
Mar 7Cloud Foundry Stratos Deploys With Public Default Session Store Secret
CVE-2019-3781
CC
CF CLI
Cloud Foundry
8.8
1%
Mar 7CF CLI does not sanitize user's password in verbose/trace/debug
CVE-2019-3775
UR
UAA Release (OSS)
Cloud Foundry
6.5
1%
Mar 7UAA allows users to modify their own email address
CVE-2019-3782
CC
CredHub CLI
Cloud Foundry
7.8
0%
Feb 13CredHub CLI writes environment variable credentials to disk
CVE-2018-15800
BS
Bits Service
Cloud Foundry
6.8
1%
Dec 10Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability
CVE-2018-15755
CF
Cf-networking
Cloud Foundry
8.8
1%
Oct 12Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server
CVE-2018-11083
BO
Bosh
Cloud Foundry
8.1
1%
Oct 5Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens…
CVE-2017-4961
BO
Bosh
Cloud Foundry
8.8
0%
Jun 13An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions
CVE-2016-3091
DI
Diego
Cloud Foundry
7.5
1%
Jun 8Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service