CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-41107Apache CloudStack - SAML Signature Exclusion | Apache Software Foundation · Apache CloudStack | Public check | 8.1 | 18% | 2024-07-19 |
| CVE-2022-35741Apache CloudStack SAML Single Sign-On XXE | Apache Software Foundation · Apache CloudStack | Possible | – | 8.0% | 2022-07-18 |
| CVE-2016-6813Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of ano… | Apache Software Foundation · Apache CloudStack | Possible | – | 5.6% | 2018-02-06 |
| CVE-2024-38346Apache CloudStack: Unauthenticated cluster service port leads to remote execution | Apache Software Foundation · Apache CloudStack | Possible | 9.8 | 3.3% | 2024-07-05 |
| CVE-2019-17562A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack… | Apache · Apache CloudStack | Possible | – | 3.0% | 2020-05-14 |
| CVE-2026-61400Apache CloudStack: Get and Run Diagnostics Command Injection | Apache Software Foundation · Apache CloudStack | Possible | 8.8 | 2.9% | 2026-08-21 |
| CVE-2022-26779Apache Cloudstack insecure random number generation affects project email invitation | Apache Software Foundation · Apache CloudStack | Possible | – | 2.9% | 2022-03-15 |
| CVE-2025-22828Apache CloudStack: Unauthorised access to annotations | Apache Software Foundation · Apache CloudStack | Possible | 4.3 | 2.1% | 2025-01-13 |
| CVE-2026-47359Apache CloudStack: OS Command Injection due to unsanitized mount command | Apache Software Foundation · Apache CloudStack | Possible | 8.8 | 2.0% | 2026-08-21 |
| CVE-2024-39864Apache CloudStack: Integration API service uses dynamic port when disabled | Apache Software Foundation · Apache CloudStack | Possible | 9.8 | 1.8% | 2024-07-05 |
| CVE-2024-50386Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure | Apache Software Foundation · Apache CloudStack | Possible | 8.5 | 1.5% | 2024-11-12 |
| CVE-2024-45219Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure | Apache Software Foundation · Apache CloudStack | Possible | 8.5 | 1.2% | 2024-10-16 |
| CVE-2013-4317In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accou… | Apache Software Foundation · Apache CloudStack | Possible | – | 1.2% | 2018-02-06 |
| CVE-2024-42222Apache CloudStack: Unauthorised Network List Access | Apache Software Foundation · Apache CloudStack | Unlikely | 4.3 | 1.0% | 2024-08-07 |
| CVE-2024-42062Apache CloudStack: User Key Exposure to Domain Admins | Apache Software Foundation · Apache CloudStack | Unlikely | 7.2 | 0.9% | 2024-08-07 |
| CVE-2025-22829Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin | Apache Software Foundation · Apache CloudStack | Unlikely | 2.3 | 0.9% | 2025-06-10 |
| CVE-2024-29006Apache CloudStack: x-forwarded-for HTTP header parsed by default | Apache Software Foundation · Apache CloudStack | Unlikely | 9.8 | 0.9% | 2024-04-04 |
| CVE-2024-29007Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences | Apache Software Foundation · Apache CloudStack | Unlikely | 7.3 | 0.8% | 2024-04-04 |
| CVE-2026-25077Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates | Apache Software Foundation · Apache CloudStack | Unlikely | 8.8 | 0.7% | 2026-05-08 |
| CVE-2025-30675Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins | Apache Software Foundation · Apache CloudStack | Unlikely | 4.7 | 0.7% | 2025-06-10 |
| CVE-2026-50112Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates | Apache Software Foundation · Apache CloudStack | Unlikely | 8.8 | 0.7% | 2026-08-21 |
| CVE-2025-26521Apache CloudStack: CKS cluster in project exposes user API keys | Apache Software Foundation · Apache CloudStack | Unlikely | 8.1 | 0.7% | 2025-06-10 |
| CVE-2025-47849Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain | Apache Software Foundation · Apache CloudStack | Unlikely | 8.8 | 0.6% | 2025-06-10 |
| CVE-2025-47713Apache CloudStack: Domain Admin can reset Admin password in Root Domain | Apache Software Foundation · Apache CloudStack | Unlikely | 8.8 | 0.6% | 2025-06-10 |
| CVE-2024-29008Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance | Apache Software Foundation · Apache CloudStack | Unlikely | 6.4 | 0.6% | 2024-04-04 |
| CVE-2026-66722Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue | Apache Software Foundation · Apache CloudStack | Unlikely | 7.2 | 0.6% | 2026-08-21 |
| CVE-2026-59799Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow | Apache Software Foundation · Apache CloudStack | Unlikely | 8.8 | 0.6% | 2026-08-21 |
| CVE-2026-61397Apache CloudStack: OAuth2 Token Cross-Request Leak | Apache Software Foundation · Apache CloudStack | Unlikely | 7.5 | 0.6% | 2026-08-21 |
| CVE-2026-59780Apache CloudStack: LDAP provider configuration disclosure | Apache Software Foundation · Apache CloudStack | Unlikely | 7.5 | 0.6% | 2026-08-21 |
| CVE-2026-59655Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure | Apache Software Foundation · Apache CloudStack | Unlikely | 7.5 | 0.6% | 2026-08-21 |
| CVE-2026-59654Apache CloudStack: DoS caused by database connections leak | Apache Software Foundation · Apache CloudStack | Unlikely | 6.8 | 0.6% | 2026-08-21 |
| CVE-2026-59085Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module | Apache Software Foundation · Apache CloudStack | Unlikely | 9.1 | 0.6% | 2026-08-21 |
| CVE-2026-61398Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI | Apache Software Foundation · Apache CloudStack | Unlikely | 9.1 | 0.6% | 2026-08-21 |
| CVE-2024-45693Apache CloudStack: Request origin validation bypass makes account takeover possible | Apache Software Foundation · Apache CloudStack | Unlikely | 8.0 | 0.5% | 2024-10-16 |
| CVE-2026-50222Apache CloudStack: Improper access control in Userdata reference APIs | Apache Software Foundation · Apache CloudStack | Unlikely | 7.5 | 0.5% | 2026-08-21 |
| CVE-2026-62440Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation | Apache Software Foundation · Apache CloudStack | Unlikely | 9.1 | 0.5% | 2026-08-21 |
| CVE-2025-66171Apache CloudStack: Any user can create a new VM from backups they should not have access to | Apache Software Foundation · Apache CloudStack | Unlikely | 6.5 | 0.5% | 2026-05-08 |
| CVE-2025-66172Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to | Apache Software Foundation · Apache CloudStack | Unlikely | 8.1 | 0.5% | 2026-05-08 |
| CVE-2026-61399Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI | Apache Software Foundation · Apache CloudStack | Unlikely | 4.8 | 0.5% | 2026-08-21 |
| CVE-2026-25199Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access | Apache Software Foundation · Apache CloudStack | Unlikely | 9.1 | 0.5% | 2026-05-08 |
| CVE-2025-59302Apache CloudStack: Potential remote code execution on Javascript engine defined rules | Apache Software Foundation · Apache CloudStack | Unlikely | 4.7 | 0.5% | 2025-11-27 |
| CVE-2025-66170Apache CloudStack: Any user can list backups that they should not have access to | Apache Software Foundation · Apache CloudStack | Unlikely | 6.5 | 0.5% | 2026-05-08 |
| CVE-2026-66721Apache CloudStack: Authorization issue with listHostTags for domain admins | Apache Software Foundation · Apache CloudStack | Unlikely | 2.7 | 0.5% | 2026-08-21 |
| CVE-2026-66797Apache CloudStack: Unauthorised comment creation and disclosure | Apache Software Foundation · Apache CloudStack | Unlikely | 5.4 | 0.5% | 2026-08-21 |
| CVE-2026-65613Apache CloudStack: Webhook Deliveries Incorrect Access | Apache Software Foundation · Apache CloudStack | Unlikely | 4.3 | 0.5% | 2026-08-21 |
| CVE-2025-69233Apache CloudStack: Domain/account resources limits not honored | Apache Software Foundation · Apache CloudStack | Unlikely | 6.5 | 0.4% | 2026-05-08 |
| CVE-2026-61422Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate | Apache Software Foundation · Apache CloudStack | Unlikely | 4.3 | 0.4% | 2026-08-21 |
| CVE-2024-45462Apache CloudStack: Incomplete session invalidation on web interface logout | Apache Software Foundation · Apache CloudStack | Unlikely | 6.3 | 0.4% | 2024-10-16 |
| CVE-2025-59454Apache CloudStack: Lack of user permission validation leading to data leak for few APIs | Apache Software Foundation · Apache CloudStack | Unlikely | 4.3 | 0.4% | 2025-11-27 |
| CVE-2025-66467Apache CloudStack: MinIO policy remains intact on bucket deletion | Apache Software Foundation · Apache CloudStack | Unlikely | 8.0 | 0.4% | 2026-05-08 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-14.