Apache CloudStack

Every one of the 51 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache CloudStack - SAML Signature ExclusionCVE-2024-41107Apache Software Foundation · CVSS 8.1 · 18% likely

   CWE-290

2. Apache CloudStack SAML Single Sign-On XXECVE-2022-35741Apache Software Foundation · 8.0% likely

   CWE-611

3. Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of ano…CVE-2016-6813Apache Software Foundation · 5.6% likely
4. Apache CloudStack: Unauthenticated cluster service port leads to remote executionCVE-2024-38346Apache Software Foundation · CVSS 9.8 · 3.3% likely

   CWE-94

5. Apache CloudStack: Get and Run Diagnostics Command InjectionCVE-2026-61400Apache Software Foundation · CVSS 8.8 · 2.9% likely

   CWE-77

6. Apache Cloudstack insecure random number generation affects project email invitationCVE-2022-26779Apache Software Foundation · 2.9% likely

   CWE-338

7. Apache CloudStack: Unauthorised access to annotationsCVE-2025-22828Apache Software Foundation · CVSS 4.3 · 2.1% likely

   CWE-200

8. Apache CloudStack: OS Command Injection due to unsanitized mount commandCVE-2026-47359Apache Software Foundation · CVSS 8.8 · 2.0% likely

   CWE-78

9. Apache CloudStack: Integration API service uses dynamic port when disabledCVE-2024-39864Apache Software Foundation · CVSS 9.8 · 1.8% likely

   CWE-665

10. Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructureCVE-2024-50386Apache Software Foundation · CVSS 8.5 · 1.5% likely

    CWE-20

11. Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureCVE-2024-45219Apache Software Foundation · CVSS 8.5 · 1.2% likely

    CWE-20

12. In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accou…CVE-2013-4317Apache Software Foundation · 1.2% likely

    CWE-200

13. Apache CloudStack: Unauthorised Network List AccessCVE-2024-42222Apache Software Foundation · CVSS 4.3 · 1.0% likely

    CWE-200

14. Apache CloudStack: User Key Exposure to Domain AdminsCVE-2024-42062Apache Software Foundation · CVSS 7.2 · 0.9% likely

    CWE-863

15. Apache CloudStack: Unauthorised access to dedicated resources in Quota pluginCVE-2025-22829Apache Software Foundation · CVSS 2.3 · 0.9% likely

    CWE-269

16. Apache CloudStack: x-forwarded-for HTTP header parsed by defaultCVE-2024-29006Apache Software Foundation · CVSS 9.8 · 0.9% likely

    CWE-290

17. Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequencesCVE-2024-29007Apache Software Foundation · CVSS 7.3 · 0.8% likely

    CWE-918

18. Apache CloudStack: Unauthenticated Command Injection in Direct Download TemplatesCVE-2026-25077Apache Software Foundation · CVSS 8.8 · 0.7% likely

    CWE-94

19. Apache CloudStack: Unauthorised template/ISO list access to the domain/resource adminsCVE-2025-30675Apache Software Foundation · CVSS 4.7 · 0.7% likely

    CWE-200

20. Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templatesCVE-2026-50112Apache Software Foundation · CVSS 8.8 · 0.7% likelycovered by CyberSIXT

    CWE-781 article

21. Apache CloudStack: CKS cluster in project exposes user API keysCVE-2025-26521Apache Software Foundation · CVSS 8.1 · 0.7% likely

    CWE-200

22. Apache CloudStack: Insecure access of user's API/Secret Keys in the same domainCVE-2025-47849Apache Software Foundation · CVSS 8.8 · 0.6% likely

    CWE-269

23. Apache CloudStack: Domain Admin can reset Admin password in Root DomainCVE-2025-47713Apache Software Foundation · CVSS 8.8 · 0.6% likely

    CWE-269

24. Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instanceCVE-2024-29008Apache Software Foundation · CVSS 6.4 · 0.6% likely

    CWE-20

25. Apache CloudStack: ProjectRole & ProjectRolePermission authorization issueCVE-2026-66722Apache Software Foundation · CVSS 7.2 · 0.6% likely

    CWE-285

26. Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable FlowCVE-2026-59799Apache Software Foundation · CVSS 8.8 · 0.6% likely

    CWE-269

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.