| CVE-2026-59654 |
Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration…
|
6.8
Medium
|
Aug 21, 2026 |
| CVE-2026-47359 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-50112 |
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-50222 |
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-59085 |
Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-59655 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-59657 |
Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-59780 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-59799 |
Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-61397 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-61398 |
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-61399 |
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-61400 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-61422 |
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-62440 |
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-65613 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-66721 |
Missing authorization issue for domain admins in CloudStack's host tags listing functionality
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-66722 |
Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-66797 |
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-68745 |
Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow…
|
Not rated
|
Aug 21, 2026 |
| CVE-2026-25199 |
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants
|
Not rated
|
May 8, 2026 |
| CVE-2026-25077 |
Account users are allowed by default to register templates to be downloaded directly to the primary storage for…
|
Not rated
|
May 8, 2026 |
| CVE-2025-69233 |
Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as…
|
6.5
Medium
|
May 8, 2026 |
| CVE-2025-66467 |
Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which…
|
8.0
High
|
May 8, 2026 |
| CVE-2025-66172 |
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0
|
Not rated
|
May 8, 2026 |