# Apache Software Foundation Apache CloudStack.

Every CVE that names Apache Software Foundation Apache CloudStack among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache CloudStack: DoS caused by database connections leak](https://agentprime.io/advisories/CVE-2026-59654.md)
  `CVE-2026-59654` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.8 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Denial of service
- [Apache CloudStack: OS Command Injection due to unsanitized mount command](https://agentprime.io/advisories/CVE-2026-47359.md)
  `CVE-2026-47359` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection
- [Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates](https://agentprime.io/advisories/CVE-2026-50112.md)
  `CVE-2026-50112` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection, Server-side request forgery (SSRF)
- [Apache CloudStack: Improper access control in Userdata reference APIs](https://agentprime.io/advisories/CVE-2026-50222.md)
  `CVE-2026-50222` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Broken access control
- [Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module](https://agentprime.io/advisories/CVE-2026-59085.md)
  `CVE-2026-59085` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure](https://agentprime.io/advisories/CVE-2026-59655.md)
  `CVE-2026-59655` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure
- [Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob](https://agentprime.io/advisories/CVE-2026-59657.md)
  `CVE-2026-59657` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure
- [Apache CloudStack: LDAP provider configuration disclosure](https://agentprime.io/advisories/CVE-2026-59780.md)
  `CVE-2026-59780` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure
- [Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow](https://agentprime.io/advisories/CVE-2026-59799.md)
  `CVE-2026-59799` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Privilege escalation
- [Apache CloudStack: OAuth2 Token Cross-Request Leak](https://agentprime.io/advisories/CVE-2026-61397.md)
  `CVE-2026-61397` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure
- [Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI](https://agentprime.io/advisories/CVE-2026-61398.md)
  `CVE-2026-61398` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-116
- [Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI](https://agentprime.io/advisories/CVE-2026-61399.md)
  `CVE-2026-61399` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.8 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-116
- [Apache CloudStack: Get and Run Diagnostics Command Injection](https://agentprime.io/advisories/CVE-2026-61400.md)
  `CVE-2026-61400` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection
- [Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate](https://agentprime.io/advisories/CVE-2026-61422.md)
  `CVE-2026-61422` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation](https://agentprime.io/advisories/CVE-2026-62440.md)
  `CVE-2026-62440` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control
- [Apache CloudStack: Webhook Deliveries Incorrect Access](https://agentprime.io/advisories/CVE-2026-65613.md)
  `CVE-2026-65613` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Information disclosure, Broken access control
- [Apache CloudStack: Authorization issue with listHostTags for domain admins](https://agentprime.io/advisories/CVE-2026-66721.md)
  `CVE-2026-66721` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 2.7 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control
- [Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue](https://agentprime.io/advisories/CVE-2026-66722.md)
  `CVE-2026-66722` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.2 High · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control
- [Apache CloudStack: Unauthorised comment creation and disclosure](https://agentprime.io/advisories/CVE-2026-66797.md)
  `CVE-2026-66797` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 5.4 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Broken access control
- [Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP](https://agentprime.io/advisories/CVE-2026-68745.md)
  `CVE-2026-68745` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.1 High · Not analysed yet · Published 21 Aug 2026 · Tags: Weak cryptography or TLS
- [Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access](https://agentprime.io/advisories/CVE-2026-25199.md)
  `CVE-2026-25199` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: Information disclosure
- [Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates](https://agentprime.io/advisories/CVE-2026-25077.md)
  `CVE-2026-25077` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 8 May 2026 · Tags: Code injection
- [Apache CloudStack: Domain/account resources limits not honored](https://agentprime.io/advisories/CVE-2025-69233.md)
  `CVE-2025-69233` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: Race condition, Denial of service
- [Apache CloudStack: MinIO policy remains intact on bucket deletion](https://agentprime.io/advisories/CVE-2025-66467.md)
  `CVE-2025-66467` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.0 High · Not analysed yet · Published 8 May 2026 · Tags: CWE-459
- [Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to](https://agentprime.io/advisories/CVE-2025-66172.md)
  `CVE-2025-66172` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.1 High · Not analysed yet · Published 8 May 2026 · Tags: Information disclosure
- [Apache CloudStack: Any user can create a new VM from backups they should not have access to](https://agentprime.io/advisories/CVE-2025-66171.md)
  `CVE-2025-66171` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: Information disclosure
- [Apache CloudStack: Any user can list backups that they should not have access to](https://agentprime.io/advisories/CVE-2025-66170.md)
  `CVE-2025-66170` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: Broken access control
- [Apache CloudStack: Potential remote code execution on Javascript engine defined rules](https://agentprime.io/advisories/CVE-2025-59302.md)
  `CVE-2025-59302` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.7 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Code injection
- [Apache CloudStack: Lack of user permission validation leading to data leak for few APIs](https://agentprime.io/advisories/CVE-2025-59454.md)
  `CVE-2025-59454` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Information disclosure
- [Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins](https://agentprime.io/advisories/CVE-2025-30675.md)
  `CVE-2025-30675` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.7 Medium · Not analysed yet · Published 10 Jun 2025 · Tags: Information disclosure
- [Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin](https://agentprime.io/advisories/CVE-2025-22829.md)
  `CVE-2025-22829` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 2.3 Low · Not analysed yet · Published 10 Jun 2025 · Tags: Privilege escalation
- [Apache CloudStack: CKS cluster in project exposes user API keys](https://agentprime.io/advisories/CVE-2025-26521.md)
  `CVE-2025-26521` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2025 · Tags: Information disclosure
- [Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain](https://agentprime.io/advisories/CVE-2025-47849.md)
  `CVE-2025-47849` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2025 · Tags: Privilege escalation
- [Apache CloudStack: Domain Admin can reset Admin password in Root Domain](https://agentprime.io/advisories/CVE-2025-47713.md)
  `CVE-2025-47713` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2025 · Tags: Privilege escalation
- [Apache CloudStack: Unauthorised access to annotations](https://agentprime.io/advisories/CVE-2025-22828.md)
  `CVE-2025-22828` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 13 Jan 2025 · Tags: Information disclosure
- [Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure](https://agentprime.io/advisories/CVE-2024-50386.md)
  `CVE-2024-50386` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.5 High · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-20
- [Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure](https://agentprime.io/advisories/CVE-2024-45219.md)
  `CVE-2024-45219` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.5 High · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-20, CWE-116
- [Apache CloudStack: Incomplete session invalidation on web interface logout](https://agentprime.io/advisories/CVE-2024-45462.md)
  `CVE-2024-45462` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.3 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: Authentication bypass
- [Apache CloudStack: Request origin validation bypass makes account takeover possible](https://agentprime.io/advisories/CVE-2024-45693.md)
  `CVE-2024-45693` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.0 High · Not analysed yet · Published 16 Oct 2024 · Tags: Cross-site request forgery (CSRF)
- [Apache CloudStack: User Key Exposure to Domain Admins](https://agentprime.io/advisories/CVE-2024-42062.md)
  `CVE-2024-42062` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.2 High · Not analysed yet · Published 7 Aug 2024 · Tags: Broken access control
- [Apache CloudStack: Unauthorised Network List Access](https://agentprime.io/advisories/CVE-2024-42222.md)
  `CVE-2024-42222` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 7 Aug 2024 · Tags: Information disclosure
- [Apache CloudStack: SAML Signature Exclusion](https://agentprime.io/advisories/CVE-2024-41107.md)
  `CVE-2024-41107` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 19 Jul 2024 · Tags: Authentication bypass
- [Apache CloudStack: Unauthenticated cluster service port leads to remote execution](https://agentprime.io/advisories/CVE-2024-38346.md)
  `CVE-2024-38346` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jul 2024 · Tags: Code injection
- [Apache CloudStack: Integration API service uses dynamic port when disabled](https://agentprime.io/advisories/CVE-2024-39864.md)
  `CVE-2024-39864` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jul 2024 · Tags: Code injection, CWE-665
- [Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance](https://agentprime.io/advisories/CVE-2024-29008.md)
  `CVE-2024-29008` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 6.4 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-20
- [Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences](https://agentprime.io/advisories/CVE-2024-29007.md)
  `CVE-2024-29007` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 7.3 High · Not analysed yet · Published 4 Apr 2024 · Tags: Server-side request forgery (SSRF)
- [Apache CloudStack: x-forwarded-for HTTP header parsed by default](https://agentprime.io/advisories/CVE-2024-29006.md)
  `CVE-2024-29006` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Apr 2024 · Tags: Authentication bypass
- [Apache CloudStack SAML Single Sign-On XXE](https://agentprime.io/advisories/CVE-2022-35741.md)
  `CVE-2022-35741` · CVE record: Apache Software Foundation Apache CloudStack · No CVSS score · Not analysed yet · Published 18 Jul 2022
- [Apache Cloudstack insecure random number generation affects project email invitation](https://agentprime.io/advisories/CVE-2022-26779.md)
  `CVE-2022-26779` · CVE record: Apache Software Foundation Apache CloudStack · No CVSS score · Not analysed yet · Published 15 Mar 2022
- [Apache Software Foundation Apache CloudStack: Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user…](https://agentprime.io/advisories/CVE-2016-6813.md)
  `CVE-2016-6813` · CVE record: Apache Software Foundation Apache CloudStack · No CVSS score · Not analysed yet · Published 6 Feb 2018
- [Apache Software Foundation Apache CloudStack: In Apache CloudStack 4.1.0 and 4.1.1…](https://agentprime.io/advisories/CVE-2013-4317.md)
  `CVE-2013-4317` · CVE record: Apache Software Foundation Apache CloudStack · No CVSS score · Not analysed yet · Published 6 Feb 2018

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-cloudstack>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-cloudstack/>. Everything for agents: <https://agentprime.io/llms.txt>.