CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,445 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,445
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache_software_foundation:apache_cloudstack. Show all products

20 CVEs, showing 1 to 20
CVESeverityTitlePublished
CVE-2026-59654Medium 6.8Apache CloudStack: DoS caused by database connections leak
Assigned by apache
Aug 21, 2026
CVE-2026-47359High 8.8Apache CloudStack: OS Command Injection due to unsanitized mount command
Assigned by apache
Aug 21, 2026
CVE-2026-50112High 8.8Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
Assigned by apache
Aug 21, 2026
CVE-2026-50222High 7.5Apache CloudStack: Improper access control in Userdata reference APIs
Assigned by apache
Aug 21, 2026
CVE-2026-59085Critical 9.1Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
Assigned by apache
Aug 21, 2026
CVE-2026-59655High 7.5Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
Assigned by apache
Aug 21, 2026
CVE-2026-59657High 7.5Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
Assigned by apache
Aug 21, 2026
CVE-2026-59780High 7.5Apache CloudStack: LDAP provider configuration disclosure
Assigned by apache
Aug 21, 2026
CVE-2026-59799High 8.8Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
Assigned by apache
Aug 21, 2026
CVE-2026-61397High 7.5Apache CloudStack: OAuth2 Token Cross-Request Leak
Assigned by apache
Aug 21, 2026
CVE-2026-61398Critical 9.1Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
Assigned by apache
Aug 21, 2026
CVE-2026-61399Medium 4.8Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
Assigned by apache
Aug 21, 2026
CVE-2026-61400High 8.8Apache CloudStack: Get and Run Diagnostics Command Injection
Assigned by apache
Aug 21, 2026
CVE-2026-61422Medium 4.3Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
Assigned by apache
Aug 21, 2026
CVE-2026-62440Critical 9.1Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
Assigned by apache
Aug 21, 2026
CVE-2026-65613Medium 4.3Apache CloudStack: Webhook Deliveries Incorrect Access
Assigned by apache
Aug 21, 2026
CVE-2026-66721Low 2.7Apache CloudStack: Authorization issue with listHostTags for domain admins
Assigned by apache
Aug 21, 2026
CVE-2026-66722High 7.2Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
Assigned by apache
Aug 21, 2026
CVE-2026-66797Medium 5.4Apache CloudStack: Unauthorised comment creation and disclosure
Assigned by apache
Aug 21, 2026
CVE-2026-68745High 8.1Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP
Assigned by apache
Aug 21, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.