CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 26, 2026, 10:30 AM ET )
This week: 4,024 CVEs published, 334 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,024 Show in the list Critical, last 7 days 334 Show in the list Healthcare-tagged, last 7 days 8 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product apache_software_foundation:apache_cloudstack . Show all products
29 CVEs, showing 1 to 29
CVE Severity Title Published CVE-2025-59454 Medium 4.3 Apache CloudStack: Lack of user permission validation leading to data leak for few APIs Assigned by apache
Nov 27, 2025 CVE-2025-59302 Medium 4.7 Apache CloudStack: Potential remote code execution on Javascript engine defined rules Assigned by apache
Nov 27, 2025 CVE-2025-66170 Medium 6.5 Apache CloudStack: Any user can list backups that they should not have access to Assigned by apache
May 8, 2026 CVE-2025-66171 Medium 6.5 Apache CloudStack: Any user can create a new VM from backups they should not have access to Assigned by apache
May 8, 2026 CVE-2025-66172 High 8.1 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to Assigned by apache
May 8, 2026 CVE-2025-66467 High 8.0 Apache CloudStack: MinIO policy remains intact on bucket deletion Assigned by apache
May 8, 2026 CVE-2025-69233 Medium 6.5 Apache CloudStack: Domain/account resources limits not honored Assigned by apache
May 8, 2026 CVE-2026-25077 High 8.8 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates Assigned by apache
May 8, 2026 CVE-2026-25199 Critical 9.1 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access Assigned by apache
May 8, 2026 CVE-2026-68745 High 8.1 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP Assigned by apache
Aug 21, 2026 CVE-2026-66797 Medium 5.4 Apache CloudStack: Unauthorised comment creation and disclosure Assigned by apache
Aug 21, 2026 CVE-2026-66722 High 7.2 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue Assigned by apache
Aug 21, 2026 CVE-2026-66721 Low 2.7 Apache CloudStack: Authorization issue with listHostTags for domain admins Assigned by apache
Aug 21, 2026 CVE-2026-65613 Medium 4.3 Apache CloudStack: Webhook Deliveries Incorrect Access Assigned by apache
Aug 21, 2026 CVE-2026-62440 Critical 9.1 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation Assigned by apache
Aug 21, 2026 CVE-2026-61422 Medium 4.3 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate Assigned by apache
Aug 21, 2026 CVE-2026-61400 High 8.8 Apache CloudStack: Get and Run Diagnostics Command Injection Assigned by apache
Aug 21, 2026 CVE-2026-61399 Medium 4.8 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI Assigned by apache
Aug 21, 2026 CVE-2026-61398 Critical 9.1 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI Assigned by apache
Aug 21, 2026 CVE-2026-61397 High 7.5 Apache CloudStack: OAuth2 Token Cross-Request Leak Assigned by apache
Aug 21, 2026 CVE-2026-59799 High 8.8 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow Assigned by apache
Aug 21, 2026 CVE-2026-59780 High 7.5 Apache CloudStack: LDAP provider configuration disclosure Assigned by apache
Aug 21, 2026 CVE-2026-59657 High 7.5 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob Assigned by apache
Aug 21, 2026 CVE-2026-59655 High 7.5 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure Assigned by apache
Aug 21, 2026 CVE-2026-59085 Critical 9.1 Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module Assigned by apache
Aug 21, 2026 CVE-2026-50222 High 7.5 Apache CloudStack: Improper access control in Userdata reference APIs Assigned by apache
Aug 21, 2026 CVE-2026-50112 High 8.8 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates Assigned by apache
Aug 21, 2026 CVE-2026-47359 High 8.8 Apache CloudStack: OS Command Injection due to unsanitized mount command Assigned by apache
Aug 21, 2026 CVE-2026-59654 Medium 6.8 Apache CloudStack: DoS caused by database connections leak Assigned by apache
Aug 21, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
