CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 26, 2026, 3:23 AM ET )
This week: 4,064 CVEs published, 327 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,064 Show in the list Critical, last 7 days 327 Show in the list Healthcare-tagged, last 7 days 9 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product apache_software_foundation:apache_cloudstack . Show all products
29 CVEs, showing 1 to 29
CVE Severity Title Published CVE-2026-59654 Medium 6.8 Apache CloudStack: DoS caused by database connections leak Assigned by apache
Aug 21, 2026 CVE-2026-47359 High 8.8 Apache CloudStack: OS Command Injection due to unsanitized mount command Assigned by apache
Aug 21, 2026 CVE-2026-50112 High 8.8 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates Assigned by apache
Aug 21, 2026 CVE-2026-50222 High 7.5 Apache CloudStack: Improper access control in Userdata reference APIs Assigned by apache
Aug 21, 2026 CVE-2026-59085 Critical 9.1 Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module Assigned by apache
Aug 21, 2026 CVE-2026-59655 High 7.5 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure Assigned by apache
Aug 21, 2026 CVE-2026-59657 High 7.5 Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob Assigned by apache
Aug 21, 2026 CVE-2026-59780 High 7.5 Apache CloudStack: LDAP provider configuration disclosure Assigned by apache
Aug 21, 2026 CVE-2026-59799 High 8.8 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow Assigned by apache
Aug 21, 2026 CVE-2026-61397 High 7.5 Apache CloudStack: OAuth2 Token Cross-Request Leak Assigned by apache
Aug 21, 2026 CVE-2026-61398 Critical 9.1 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI Assigned by apache
Aug 21, 2026 CVE-2026-61399 Medium 4.8 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI Assigned by apache
Aug 21, 2026 CVE-2026-61400 High 8.8 Apache CloudStack: Get and Run Diagnostics Command Injection Assigned by apache
Aug 21, 2026 CVE-2026-61422 Medium 4.3 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate Assigned by apache
Aug 21, 2026 CVE-2026-62440 Critical 9.1 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation Assigned by apache
Aug 21, 2026 CVE-2026-65613 Medium 4.3 Apache CloudStack: Webhook Deliveries Incorrect Access Assigned by apache
Aug 21, 2026 CVE-2026-66721 Low 2.7 Apache CloudStack: Authorization issue with listHostTags for domain admins Assigned by apache
Aug 21, 2026 CVE-2026-66722 High 7.2 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue Assigned by apache
Aug 21, 2026 CVE-2026-66797 Medium 5.4 Apache CloudStack: Unauthorised comment creation and disclosure Assigned by apache
Aug 21, 2026 CVE-2026-68745 High 8.1 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP Assigned by apache
Aug 21, 2026 CVE-2026-25199 Critical 9.1 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access Assigned by apache
May 8, 2026 CVE-2026-25077 High 8.8 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates Assigned by apache
May 8, 2026 CVE-2025-69233 Medium 6.5 Apache CloudStack: Domain/account resources limits not honored Assigned by apache
May 8, 2026 CVE-2025-66467 High 8.0 Apache CloudStack: MinIO policy remains intact on bucket deletion Assigned by apache
May 8, 2026 CVE-2025-66172 High 8.1 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to Assigned by apache
May 8, 2026 CVE-2025-66171 Medium 6.5 Apache CloudStack: Any user can create a new VM from backups they should not have access to Assigned by apache
May 8, 2026 CVE-2025-66170 Medium 6.5 Apache CloudStack: Any user can list backups that they should not have access to Assigned by apache
May 8, 2026 CVE-2025-59302 Medium 4.7 Apache CloudStack: Potential remote code execution on Javascript engine defined rules Assigned by apache
Nov 27, 2025 CVE-2025-59454 Medium 4.3 Apache CloudStack: Lack of user permission validation leading to data leak for few APIs Assigned by apache
Nov 27, 2025
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
