Product by Apache Software Foundation

    Cloudstack Lts

    20 known vulnerabilities in Cloudstack Lts (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Cloudstack Lts (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    HighCVE-2026-61400

    Apache CloudStack: Get and Run Diagnostics Command Injection

    		8.8
    HighCVE-2026-47359

    Apache CloudStack: OS Command Injection due to unsanitized mount command

    		8.8
    HighCVE-2026-50112

    Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

    		8.8
    CriticalCVE-2026-59085

    Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module

    		9.1
    CriticalCVE-2026-61398

    Apache CloudStack: Improper Encoding or Escaping of Output

    		9.1
    HighCVE-2026-59799

    Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

    		8.8
    CriticalCVE-2026-62440

    Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

    		9.1
    HighCVE-2026-59654

    Apache CloudStack: DoS caused by database connections leak

    		7.5
    HighCVE-2026-59780

    Apache CloudStack: LDAP provider configuration disclosure

    		7.5
    HighCVE-2026-61397

    Apache CloudStack: OAuth2 Token Cross-Request Leak

    		7.5
    HighCVE-2026-59655

    Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

    		7.5
    HighCVE-2026-66722

    Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue

    		7.2
    HighCVE-2026-50222

    Apache CloudStack: Improper access control in Userdata reference APIs

    		7.5
    HighCVE-2026-59657

    Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob

    		7.5
    HighCVE-2026-68745

    Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP

    		8.1
    MediumCVE-2026-66797

    Apache CloudStack: Unauthorised comment creation and disclosure

    		5.4
    MediumCVE-2026-61399

    Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

    		4.8
    MediumCVE-2026-65613

    Apache CloudStack: Webhook Deliveries Incorrect Access

    		4.3
    MediumCVE-2026-61422

    Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate

    		4.3
    LowCVE-2026-66721

    Apache CloudStack: Authorization issue with listHostTags for domain admins

    		2.7

    All products by Apache Software Foundation