Known vulnerabilities in Apache CloudStack
Vendor:
Apache Foundation
Software:
Apache CloudStack
Software CPE:
cpe:2.3:a:apache_foundation:apache_cloudstack:*:*:*:*:*:*:*:*
Website:
https://www.apache.org
Total vulnerabilities:
31
Public exploits:
0
Known exploited (KEV):
0
Highest CVSSv4 Score:
9.4
Breakdown by Severity Chart
4.23.0.0
4.22.1.1
4.20.3.1
4.22.1.0
4.22.0.1
4.20.3.0
4.22.0.0
4.20.2.0
4.21.0.0
4.19.3.0
4.20.1.0
4.19.2.0
4.20.0.0
4.19.1.3
4.19.1.2
4.19.1.1
4.19.1.0
4.19.0.2
4.19.0.1
4.19.0.0
4.18.2.5
4.18.2.4
4.18.2.3
4.18.2.2
4.18.2.1
4.18.2.0
4.18.1.1
4.18.1.0
4.18.0.0
4.17.2.0
4.17.1.0
4.17.0.1
4.17.0.0
4.16.1.1
4.16.1.0
4.16.0.0
4.15.2.0
4.15.1.0
4.15.0.0
4.14.1.0
4.14.0.0
4.13.1.0
4.13.0.0
4.12.0.0
4.11.3.0
4.11.2.0
4.11.1.0
4.11.1
4.11.0.0
4.10.0.0
4.9.3.1
4.9.3.0
4.9.2.0
4.9.1.0
4.9.0.1
4.9.0
4.8.2.0
4.8.1.1
4.8.1
4.8.0.1
4.8.0
4.7.1.1
4.7.1
4.7.0
4.6.2.1
4.6.2
4.6.1
4.6.0
4.5.2.2
4.5.2.1
4.5.2
4.5.1
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0
4.3.2
4.3.1
4.3.0
4.2.1
4.2.0
4.1.1
4.1.0
4.0.2
2.2.1
2.2.0
2.1.99
2.1.98
2.1.7
2.1.6
2.1.5
2.1.4
2.1.3
Vulnerabilities (31)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU144664 - Missing Release of Resource after Effective Lifetime CVE-2026-59654 |
CWE-772 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144644 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CVE-2026-47359 |
CWE-78 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144645 - Improper input validation CVE-2026-50112 |
CWE-20 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144646 - Improper Access Control CVE-2026-50222 |
CWE-284 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144647 - Server-Side Request Forgery (SSRF) CVE-2026-59085 |
CWE-918 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144648 - Improper Access Control CVE-2026-59655 |
CWE-284 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144649 - Cleartext Storage of Sensitive Information CVE-2026-59657 |
CWE-312 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144650 - Improper Access Control CVE-2026-59780 |
CWE-284 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144651 - Improper Privilege Management CVE-2026-59799 |
CWE-269 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144652 - Exposure of sensitive information to an unauthorized actor CVE-2026-61397 |
CWE-200 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144653 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-61398 |
CWE-79 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144654 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-61399 |
CWE-79 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144655 - Command injection CVE-2026-61400 |
CWE-77 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144656 - Server-Side Request Forgery (SSRF) CVE-2026-61422 |
CWE-918 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144657 - Improper Access Control CVE-2026-62440 |
CWE-284 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144658 - Improper Access Control CVE-2026-65613 |
CWE-284 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144659 - Missing Authorization CVE-2026-66721 |
CWE-862 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144660 - Incorrect Authorization CVE-2026-66722 |
CWE-863 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144661 - Improper Access Control CVE-2026-66797 |
CWE-284 | Low | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
||
| #VU144662 - Improper Certificate Validation CVE-2026-68745 |
CWE-295 | Medium | 4.20.3.1, 4.22.1.1 | 24.08.2026 |
SB2026082482 |
Showing elements 1 - 20 out of 31