Product by Apache Software Foundation

    Apache CloudStack

    65 known vulnerabilities in Apache CloudStack (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    65

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache CloudStack (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    HighCVE-2026-61400

    Apache CloudStack: Get and Run Diagnostics Command Injection

    		8.8
    CriticalCVE-2022-35741

    Apache CloudStack SAML Single Sign-On XXE

    		9.8
    HighCVE-2024-41107

    Apache CloudStack: SAML Signature Exclusion

    		8.1
    HighCVE-2026-47359

    Apache CloudStack: OS Command Injection due to unsanitized mount command

    		8.8
    CriticalCVE-2016-6813

    Apache CloudStack: security vulnerability

    		9.8
    CriticalCVE-2024-38346

    Apache CloudStack: Unauthenticated cluster service port leads to remote execution

    		9.8
    CriticalCVE-2019-17562

    Apache CloudStack: Buffer Overflow

    		9.8
    CriticalCVE-2024-39864

    Apache CloudStack: Integration API service uses dynamic port when disabled

    		9.8
    CriticalCVE-2015-3252

    Apache CloudStack: security vulnerability

    		9.8
    HighCVE-2022-26779

    Apache Cloudstack insecure random number generation affects project email invitation

    		7.5
    CriticalCVE-2024-50386

    Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure

    		8.5
    MediumCVE-2016-3085

    Apache CloudStack: Authentication Bypass

    		6.5
    HighCVE-2026-50112

    Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

    		8.8
    CriticalCVE-2026-59085

    Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module

    		9.1
    CriticalCVE-2026-61398

    Apache CloudStack: Improper Encoding or Escaping of Output

    		9.1
    HighCVE-2026-59799

    Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

    		8.8
    HighCVE-2024-45219

    Apache CloudStack: Improper Input Validation

    		8.5
    CriticalCVE-2026-62440

    Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

    		9.1
    HighCVE-2026-25077

    Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

    		8.8
    MediumCVE-2025-22828

    Apache CloudStack: Unauthorised access to annotations

    		4.3
    CriticalCVE-2024-29006

    Apache CloudStack: x-forwarded-for HTTP header parsed by default

    		9.8
    MediumCVE-2015-3251

    Apache CloudStack: security vulnerability

    		4.9
    HighCVE-2026-59654

    Apache CloudStack: DoS caused by database connections leak

    		7.5
    HighCVE-2026-59780

    Apache CloudStack: LDAP provider configuration disclosure

    		7.5
    HighCVE-2026-61397

    Apache CloudStack: OAuth2 Token Cross-Request Leak

    		7.5

    All vulnerabilities in search

    All products by Apache Software Foundation