Login Request a demo
CL
Vendor
Cloudfoundry
31 products with CVEs on record
171
CVEs
0
On KEV
0
New 30D
Products
CF
Cf-deployment
Cloudfoundry
9.8
37 CVEs0 on KEV0 new
CF
Cf-release
Cloudfoundry
9.8
35 CVEs0 on KEV0 new
CA
Capi-release
Cloudfoundry
8.8
22 CVEs0 on KEV0 new
CF
Cloud Foundry Uaa Bosh
Cloudfoundry
9.8
15 CVEs0 on KEV0 new
RR
Routing Release
Cloudfoundry
9.8
13 CVEs0 on KEV0 new
UA
User Account And Authentication
Cloudfoundry
8.8
9 CVEs0 on KEV0 new
UR
Uaa Release
Cloudfoundry
9.8
8 CVEs0 on KEV0 new
BC
Bosh Cli
Cloudfoundry
9.1
4 CVEs0 on KEV0 new
CR
Container Runtime
Cloudfoundry
8.8
2 CVEs0 on KEV0 new
CR
Credhub
Cloudfoundry
9.8
2 CVEs0 on KEV0 new
GA
Garden-runc
Cloudfoundry
6.5
2 CVEs0 on KEV0 new
LO
Loggregator
Cloudfoundry
6.8
2 CVEs0 on KEV0 new
ST
Stratos
Cloudfoundry
8.8
2 CVEs0 on KEV0 new
AR
Archiver
Cloudfoundry
9.1
1 CVEs0 on KEV0 new
BA
Bosh Azure Cpi
Cloudfoundry
8.8
1 CVEs0 on KEV0 new
BB
Bosh Backup And Restore
Cloudfoundry
7.1
1 CVEs0 on KEV0 new
CF
Cf-mysql-release
Cloudfoundry
9.8
1 CVEs0 on KEV0 new
CF
Cloud Foundry
Cloudfoundry
7.5
1 CVEs0 on KEV0 new
CL
Command Line Interface
Cloudfoundry
8.8
1 CVEs0 on KEV0 new
CC
Credhub Cli
Cloudfoundry
7.8
1 CVEs0 on KEV0 new
DI
Diego
Cloudfoundry
9.1
1 CVEs0 on KEV0 new
GA
Garden
Cloudfoundry
7.5
1 CVEs0 on KEV0 new
GL
Garden Linux
Cloudfoundry
9.8
1 CVEs0 on KEV0 new
GA
Garden-runc-release
Cloudfoundry
8.8
1 CVEs0 on KEV0 new
GO
Gorouter
Cloudfoundry
7.7
1 CVEs0 on KEV0 new
JB
Java Buildpack
Cloudfoundry
5.9
1 CVEs0 on KEV0 new
LO
Loggregator-agent
Cloudfoundry
8.1
1 CVEs0 on KEV0 new
NV
Nfs Volume Release
Cloudfoundry
8.1
1 CVEs0 on KEV0 new
PH
Php-buildpack
Cloudfoundry
7.5
1 CVEs0 on KEV0 new
SI
Silk-release
Cloudfoundry
8.1
1 CVEs0 on KEV0 new
SB
Staticfile Buildpack
Cloudfoundry
5.9
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-47829
BC
Bosh Cli
Cloudfoundry
7.8
0%
Jul 9Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director
CVE-2026-47828
BC
Bosh Cli
Cloudfoundry
8.8
0%
Jul 9Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay
CVE-2026-47826
BC
Bosh Cli
Cloudfoundry
9.1
1%
Jul 9blobs.yaml Path Traversal Allows File Writes
CVE-2026-41857
BC
Bosh Cli
Cloudfoundry
7.8
0%
Jul 9BOSH CLI Shell Injection
CVE-2026-22726
CF
Cf-deployment
Cloudfoundry
5.0
0%
Apr 30Route Services Firewall Bypass
CVE-2026-22727
CF
Cloud Foundry
Cloudfoundry
7.5
0%
Mar 17Cloud Foundry unprotected internal endpoints
CVE-2026-22723
UA
Uaa-release
Cloudfoundry
6.5
0%
Mar 5UAA User Token Revocation logic error
CVE-2025-22246
CF
Cf-deployment
Cloudfoundry
7.5
0%
May 13Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs
CVE-2024-22279
CF
Cf-deployment
Cloudfoundry
7.5
0%
Jun 10Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment…
CVE-2023-34041
CF
Cf-deployment
Cloudfoundry
5.3
0%
Sep 8Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers
CVE-2023-20882
RR
Routing Release
Cloudfoundry
5.9
1%
May 26In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry
CVE-2023-20881
CA
Capi-release
Cloudfoundry
8.1
0%
May 19Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the…
CVE-2023-20903
UA
User Account And Authentication
Cloudfoundry
4.3
0%
Mar 28This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh…
CVE-2022-31733
CF
Cf-deployment
Cloudfoundry
9.1
0%
Feb 3Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing…
CVE-2018-25046
AR
Archiver
Cloudfoundry
9.1
1%
Dec 27Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory
CVE-2021-22100
CF
Cf-deployment
Cloudfoundry
5.3
1%
Mar 25In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to…
CVE-2021-22101
CA
Capi-release
Cloudfoundry
7.5
1%
Oct 27Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by…
CVE-2021-22098
CF
Cf-deployment
Cloudfoundry
6.1
1%
Aug 11UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability
CVE-2021-22001
UA
User Account And Authentication
Cloudfoundry
7.5
1%
Jul 22In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type…
CVE-2021-22115
CA
Capi-release
Cloudfoundry
6.5
1%
Apr 8Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed
CVE-2020-5423
CA
Capi-release
Cloudfoundry
7.5
1%
Dec 2CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files…
CVE-2020-5420
GO
Gorouter
Cloudfoundry
7.7
1%
Sep 3Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a malicious developer with "cf push" access to cause denial-of-service to the CF cluster by pushing an app that…
CVE-2020-5418
CA
Capi-release
Cloudfoundry
4.3
1%
Sep 3Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all…
CVE-2020-5417
CF
Cf-deployment
Cloudfoundry
8.8
1%
Aug 21Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF…
CVE-2020-5416
RO
Routing-release
Cloudfoundry
6.5
1%
Aug 21Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to…
CVE-2020-15586
RO
Routing-release
Cloudfoundry
5.9
3%
Jul 17Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and…
CVE-2020-5402
CF
Cf-deployment
Cloudfoundry
8.8
0%
Feb 27In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with…
CVE-2020-5401
RR
Routing Release
Cloudfoundry
5.3
1%
Feb 27Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent…
CVE-2020-5400
CA
Capi-release
Cloudfoundry
6.5
1%
Feb 27Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials…
CVE-2020-5399
CR
Credhub
Cloudfoundry
7.4
1%
Feb 12Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS
CVE-2019-11294
CA
Capi-release
Cloudfoundry
4.3
1%
Dec 19Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only…
CVE-2019-11293
CF
Cf-deployment
Cloudfoundry
6.5
1%
Dec 6Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter
CVE-2019-11290
CF
Cf-deployment
Cloudfoundry
7.5
1%
Nov 26Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file
CVE-2019-11289
CF
Cf-deployment
Cloudfoundry
8.6
2%
Nov 19Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input
CVE-2019-11283
CF
Cf-deployment
Cloudfoundry
8.8
1%
Oct 23Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs
CVE-2019-11282
CF
Cf-deployment
Cloudfoundry
4.3
1%
Oct 23Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack
CVE-2019-11279
UR
Uaa Release
Cloudfoundry
8.8
1%
Sep 26CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes
CVE-2019-11278
UA
User Account And Authentication
Cloudfoundry
8.8
1%
Sep 26CF UAA versions prior to 74.1.0, allow external input to be directly queried against
CVE-2019-11277
NV
Nfs Volume Release
Cloudfoundry
8.1
2%
Sep 23Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection
CVE-2019-11274
UA
User Account And Authentication
Cloudfoundry
6.1
1%
Aug 9Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack
CVE-2019-3801
CR
Credhub
Cloudfoundry
9.8
1%
Apr 25Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building
CVE-2019-3788
UR
Uaa Release
Cloudfoundry
6.1
1%
Apr 25Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri
CVE-2019-3789
RR
Routing Release
Cloudfoundry
6.5
1%
Apr 24Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform
CVE-2019-3786
BB
Bosh Backup And Restore
Cloudfoundry
7.1
1%
Apr 24Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH
CVE-2019-3798
CA
Capi-release
Cloudfoundry
7.5
1%
Apr 17Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions
CVE-2019-3785
CA
Capi-release
Cloudfoundry
8.1
1%
Mar 13Cloud Controller provides signed URL with write authorization to read only user
CVE-2019-3779
CR
Container Runtime
Cloudfoundry
8.8
1%
Mar 8Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD
CVE-2019-3780
CR
Container Runtime
Cloudfoundry
8.8
1%
Mar 8Cloud Foundry Container Runtime Leaks IAAS Credentials
CVE-2019-3784
ST
Stratos
Cloudfoundry
6.5
1%
Mar 7Cloud Foundry Stratos contains a Session Collision Vulnerability
CVE-2019-3783
ST
Stratos
Cloudfoundry
8.8
1%
Mar 7Cloud Foundry Stratos Deploys With Public Default Session Store Secret
CVE-2019-3781
CL
Command Line Interface
Cloudfoundry
8.8
1%
Mar 7CF CLI does not sanitize user's password in verbose/trace/debug
CVE-2019-3775
UR
Uaa Release
Cloudfoundry
6.5
1%
Mar 7UAA allows users to modify their own email address
CVE-2019-3782
CC
Credhub Cli
Cloudfoundry
7.8
0%
Feb 13CredHub CLI writes environment variable credentials to disk
CVE-2018-11084
GA
Garden-runc
Cloudfoundry
6.5
1%
Sep 18Cloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes
CVE-2016-0708
CF
Cf-release
Cloudfoundry
5.9
2%
Jul 11Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables…
CVE-2018-1269
LO
Loggregator
Cloudfoundry
6.5
1%
Jun 6Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown…
CVE-2018-1268
LO
Loggregator
Cloudfoundry
6.8
1%
Jun 6Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID…
CVE-2018-1265
CF
Cf-deployment
Cloudfoundry
7.2
2%
Jun 6Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers
CVE-2018-1193
CF
Cf-deployment
Cloudfoundry
5.3
1%
May 23Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers
CVE-2018-1262
CF
Cf-deployment
Cloudfoundry
7.2
1%
May 15Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline…