Apache · product
Apache CloudStack
52 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 1
Every one of the 52 is a mark on the map. Named now: 27 to 52, most at risk first.
- Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
- Apache CloudStack: OAuth2 Token Cross-Request Leak
- Apache CloudStack: LDAP provider configuration disclosure
- Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
- Apache CloudStack: DoS caused by database connections leak
- Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
- Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
- Apache CloudStack: Request origin validation bypass makes account takeover possible
- Apache CloudStack: Improper access control in Userdata reference APIs
- Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
- Apache CloudStack: Any user can create a new VM from backups they should not have access to
- Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to
- Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
- Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
- Apache CloudStack: Potential remote code execution on Javascript engine defined rules
- Apache CloudStack: Any user can list backups that they should not have access to
- Apache CloudStack: Authorization issue with listHostTags for domain admins
- Apache CloudStack: Unauthorised comment creation and disclosure
- Apache CloudStack: Webhook Deliveries Incorrect Access
- Apache CloudStack: Domain/account resources limits not honored
- Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
- Apache CloudStack: Incomplete session invalidation on web interface logout
- Apache CloudStack: Lack of user permission validation leading to data leak for few APIs
- Apache CloudStack: MinIO policy remains intact on bucket deletion
- Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
- Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP