How many Apache Software Foundation cloudstack CVEs are in CISA KEV?

None of Apache Software Foundation cloudstack's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Apache Software Foundation cloudstack are affected?

172 distinct Apache Software Foundation cloudstack versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation cloudstack CVEs?

Apache Software Foundation cloudstack's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-20 (Improper Input Validation), CWE-269 (Improper Privilege Management).

What is the average severity of Apache Software Foundation cloudstack CVEs?

The average CVSS base score across Apache Software Foundation cloudstack's scored CVEs is 6.8.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Apache Software Foundation

45 CVEs

Apache Software Foundation cloudstack Vulnerabilities

Name: Apache Software Foundation cloudstack vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for cloudstack by Apache Software Foundation.

45

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

3

Public exploits

PoC or exploit code

6.8

Avg CVSS

2012–2026

Last updated May 8, 2026

Overview

Apache Software Foundation cloudstack has 45 published CVE records since 2012, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation cloudstack, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation cloudstack's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical10

High13

Medium19

Low3

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Apache Software Foundation cloudstack's CVEs are currently listed in CISA's KEV catalog.

Public exploits

3

3 of Apache Software Foundation cloudstack's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation cloudstack version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

4.19.0.014 CVEs
acton-beta1-prerelease-112 CVEs
ovm312 CVEs
tag-3.0.1-prerelease-112 CVEs
4.12.0.010 CVEs
4.16.0.09 CVEs
4.17.0.09 CVEs
4.18.0.09 CVEs
4.19.1.08 CVEs
4.20.0.07 CVEs
4.19.1.15 CVEs
4.18.1.04 CVEs
4.21.0.03 CVEs
4.19.0.12 CVEs
4.20.1.02 CVEs
4.16.1.01 CVE
4.18.2.01 CVE
4.18.2.11 CVE
4.19.1.21 CVE
4.19.2.01 CVE
4.5.11 CVE
4.6.01 CVE
4.6.11 CVE
4.6.21 CVE
4.6.2-rc11 CVE
4.7.01 CVE
4.7.0-rc11 CVE
4.8.01 CVE
4.9.01 CVE
shapeblue-4.5.2-saml1 CVE
shapeblue-4.6.0-001 CVE
shapeblue-4.6.1-001 CVE

Version ranges

4.21.0.0 <= v < 4.22.0.17 CVEs
4.0.0 <= v <= 4.0.06 CVEs
4.0.1 <= v <= 4.0.15 CVEs
4.0.2 <= v <= 4.0.25 CVEs
4.19.0.0 <= v < 4.19.1.24 CVEs
4.20.0.0 <= v < 4.20.1.04 CVEs
2.0 <= v <= 2.03 CVEs
2.0.1 <= v <= 2.0.13 CVEs
2.1.0 <= v <= 2.1.03 CVEs
2.1.1 <= v <= 2.1.13 CVEs
2.1.10 <= v <= 2.1.103 CVEs
2.1.2 <= v <= 2.1.23 CVEs
2.1.3 <= v <= 2.1.33 CVEs

Fixed in

4.22.0.17 CVEs
0c7d47138d448ef7d6b449b3401f2575bd795e574 CVEs
18fe4226cecc930ec0b39c43e5b63a48c17c2ad44 CVEs
4.18.2.44 CVEs
4.19.1.24 CVEs
4.19.3.04 CVEs
4.20.1.04 CVEs
54b3519df120255cd43d5ad290ffa0e99a9547aa4 CVEs
c61a5eb430a8ced2b10d7cec9948a8704c2c52ac4 CVEs
4.18.1.13 CVEs
4.20.3.03 CVEs
b28f3cd788f74575449461af72ee98941cb2ab683 CVEs

Find a version

45 CVEs

Sort

Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
CVE-2026-25199
Patch
CWE-200
Critical · CVSS 9.1
EPSS 0.5% (40th pct)2026-05-08
Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates
CVE-2026-25077
Patch
CWE-94
High · CVSS 8.8
EPSS 0.7% (50th pct)2026-05-08
Apache CloudStack: Domain/account resources limits not honored
CVE-2025-69233
Patch
CWE-770
Medium · CVSS 6.5
EPSS 0.4% (35th pct)2026-05-08
Apache CloudStack: MinIO policy remains intact on bucket deletion
CVE-2025-66467
Patch
CWE-459
High · CVSS 8.1
EPSS 0.4% (30th pct)2026-05-08
Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to
CVE-2025-66172
Patch
CWE-359
High · CVSS 8.1
EPSS 0.5% (40th pct)2026-05-08
Apache CloudStack: Any user can create a new VM from backups they should not have access to
CVE-2025-66171
Patch
CWE-359
Medium · CVSS 6.5
EPSS 0.5% (41th pct)2026-05-08
Apache CloudStack: Any user can list backups that they should not have access to
CVE-2025-66170
Patch
CWE-863
Medium · CVSS 6.5
EPSS 0.5% (39th pct)2026-05-08
Apache CloudStack: Potential remote code execution on Javascript engine defined rules
CVE-2025-59302
Patch
CWE-94
Medium · CVSS 4.7
EPSS 0.4% (32th pct)2025-11-27
Apache CloudStack: Lack of user permission validation leading to data leak for few APIs
CVE-2025-59454
Patch
CWE-200
Medium · CVSS 4.3
EPSS 0.3% (24th pct)2025-11-27
Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins
CVE-2025-30675
Patch
CWE-200
Medium · CVSS 4.7
EPSS 0.6% (43th pct)2025-06-10
Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
CVE-2025-22829
Patch
CWE-269
Low · CVSS 2.3
EPSS 0.7% (49th pct)2025-06-10
Apache CloudStack: CKS cluster in project exposes user API keys
CVE-2025-26521
Patch
CWE-200
High · CVSS 8.1
EPSS 0.6% (45th pct)2025-06-10
Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain
CVE-2025-47849
Patch
CWE-269
High · CVSS 8.8
EPSS 0.5% (40th pct)2025-06-10
Apache CloudStack: Domain Admin can reset Admin password in Root Domain
CVE-2025-47713
Patch
CWE-269
High · CVSS 8.8
EPSS 0.5% (40th pct)2025-06-10
Apache CloudStack: Unauthorised access to annotations
CVE-2025-22828
Public exploit
Patch
CWE-200
Medium · CVSS 4.3
EPSS 1.9% (78th pct)2025-01-13
Critical vulnerability · 2024-11-12
CVE-2024-50386
Patch
CWE-20
Critical · CVSS 9.9
EPSS 1.4% (70th pct)2024-11-12
Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure
CVE-2024-45219
Patch
CWE-20
High · CVSS 8.5
EPSS 1.2% (66th pct)2024-10-16
Medium vulnerability · 2024-10-16
CVE-2024-45461
Patch
CWE-862
Medium · CVSS 6.3
EPSS 0.7% (49th pct)2024-10-16
High vulnerability · 2024-10-16
CVE-2024-45462
Patch
CWE-613
High · CVSS 7.1
EPSS 0.4% (32th pct)2024-10-16
Apache CloudStack: Request origin validation bypass makes account takeover possible
CVE-2024-45693
Patch
CWE-352
High · CVSS 8.8
EPSS 0.5% (39th pct)2024-10-16
Apache CloudStack: User Key Exposure to Domain Admins
CVE-2024-42062
Patch
CWE-863
High · CVSS 7.2
EPSS 0.9% (57th pct)2024-08-07
Medium vulnerability · 2024-08-07
CVE-2024-42222
Patch
CWE-200
Medium · CVSS 4.3
EPSS 1.0% (58th pct)2024-08-07
High vulnerability · 2024-07-19
CVE-2024-41107
Public exploit
Patch
CWE-290
High · CVSS 8.1
EPSS 17.8% (97th pct)2024-07-19
Critical vulnerability · 2024-07-05
CVE-2024-38346
Patch
CWE-94
Critical · CVSS 9.8
EPSS 3.3% (87th pct)2024-07-05
Apache CloudStack: Integration API service uses dynamic port when disabled
CVE-2024-39864
Patch
CWE-94
Critical · CVSS 9.8
EPSS 1.8% (76th pct)2024-07-05
Medium vulnerability · 2024-04-04
CVE-2024-29008
Patch
CWE-20
Medium · CVSS 6.4
EPSS 0.6% (46th pct)2024-04-04
Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences
CVE-2024-29007
Patch
CWE-918
High · CVSS 7.3
EPSS 0.8% (52th pct)2024-04-04
Apache CloudStack: x-forwarded-for HTTP header parsed by default
CVE-2024-29006
Patch
CWE-290
Critical · CVSS 9.8
EPSS 0.9% (55th pct)2024-04-04
Critical vulnerability · 2022-07-18
CVE-2022-35741
Patch
Workaround
Critical · CVSS 9.8
EPSS 7.9% (94th pct)2022-07-18
High vulnerability · 2022-03-15
CVE-2022-26779
Patch
High · CVSS 7.5
EPSS 2.8% (85th pct)2022-03-15

Showing 30 of 45

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation cloudstack CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Apache Software Foundation cloudstack CVEs were published each year.

2012

1

2013

2

2014

5

2015

1

2016

3

2018

2

2020

1

2022

2

2024

13

2025

8

2026

7

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server351 CVEs tomcat265 CVEs airflow183 CVEs Apache Airflow136 CVEs apache-airflow127 CVEs Apache HTTP Server125 CVEs httpd125 CVEs org.apache.tomcat:tomcat118 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation cloudstack vulnerabilities.

How many CVEs does Apache Software Foundation cloudstack have?: Apache Software Foundation cloudstack has 45 published CVE records since 2012.
How many Apache Software Foundation cloudstack CVEs are in CISA KEV?: None of Apache Software Foundation cloudstack's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Apache Software Foundation cloudstack vulnerabilities?: Yes — 3 of Apache Software Foundation cloudstack's CVEs have a known public exploit.
Which versions of Apache Software Foundation cloudstack are affected?: 172 distinct Apache Software Foundation cloudstack versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation cloudstack CVEs?: Apache Software Foundation cloudstack's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-20 (Improper Input Validation), CWE-269 (Improper Privilege Management).
How many critical Apache Software Foundation cloudstack vulnerabilities are there?: Apache Software Foundation cloudstack has 10 critical and 13 high-severity CVEs.
What is the average severity of Apache Software Foundation cloudstack CVEs?: The average CVSS base score across Apache Software Foundation cloudstack's scored CVEs is 6.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation cloudstack vulnerabilities

Monitor new Apache Software Foundation cloudstack vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

2.1.4 <= v <= 2.1.43 CVEs

2.1.5 <= v <= 2.1.53 CVEs

2.1.6 <= v <= 2.1.63 CVEs

2.1.7 <= v <= 2.1.73 CVEs

2.1.8 <= v <= 2.1.83 CVEs

2.1.9 <= v <= 2.1.93 CVEs

2.2.0 <= v <= 2.2.03 CVEs

2.2.1 <= v <= 2.2.13 CVEs

2.2.11 <= v <= 2.2.113 CVEs

2.2.12 <= v <= 2.2.123 CVEs

2.2.13 <= v <= 2.2.133 CVEs

2.2.14 <= v <= 2.2.143 CVEs

2.2.2 <= v <= 2.2.23 CVEs

2.2.3 <= v <= 2.2.33 CVEs

2.2.5 <= v <= 2.2.53 CVEs

2.2.6 <= v <= 2.2.63 CVEs

2.2.7 <= v <= 2.2.73 CVEs

2.2.8 <= v <= 2.2.83 CVEs

2.2.9 <= v <= 2.2.93 CVEs

3.0.0 <= v <= 3.0.03 CVEs

3.0.1 <= v <= 3.0.13 CVEs

3.0.2 <= v <= 3.0.23 CVEs

4.1.0 <= v <= 4.1.03 CVEs

4.1.1 <= v <= 4.1.13 CVEs

4.19.0.0 <= v <= 4.19.0.03 CVEs

<= 4.2.02 CVEs

>= 4.19.0.02 CVEs

4.0.0 <= v < 4.18.2.12 CVEs

4.10.0.0 <= v < 4.19.3.02 CVEs

4.15.1.0 <= v < 4.18.2.42 CVEs

4.19.0.0 <= v < 4.19.0.22 CVEs

4.21.0.0 <= v <= 4.21.0.02 CVEs

4.4.0 <= v <= 4.4.02 CVEs

4.4.1 <= v <= 4.4.12 CVEs

4.5.1 <= v <= 4.5.12 CVEs

< 4.13.1.01 CVE

< 4.16.1.01 CVE

<= 4.1.01 CVE

<= 4.3.11 CVE

<= 4.5.11 CVE

>= 4.16.0.01 CVE

4.0.0 <= v < 4.18.2.41 CVE

4.0.0 <= v < 4.18.2.51 CVE

4.0.0 <= v < 4.19.3.01 CVE

4.0.0 <= v < 4.20.2.01 CVE

4.0.0 <= v < 4.20.3.01 CVE

4.0.0 <= v <= 4.18.2.41 CVE

4.1.0 <= v <= 4.8.1.01 CVE

4.10.0.0 <= v < 4.18.2.31 CVE

4.10.0.0 <= v <= 4.18.2.21 CVE

4.11.0.0 <= v < 4.18.1.11 CVE

4.11.0.0 <= v < 4.20.3.01 CVE

4.14.0.0 <= v < 4.18.1.11 CVE

4.14.0.0 <= v <= 4.18.1.01 CVE

4.15.1.0 <= v <= 4.18.2.31 CVE

4.17.0.0 <= v < 4.19.3.01 CVE

4.17.0.0 <= v <= 4.17.0.01 CVE

4.18.0.0 <= v < 4.20.2.01 CVE

4.19.0.0 <= v < 4.19.1.01 CVE

4.19.0.0 <= v < 4.19.1.11 CVE

4.19.0.0 <= v < 4.19.1.31 CVE

4.19.0.0 <= v < 4.20.3.01 CVE

4.19.0.0 <= v <= 4.19.1.01 CVE

4.19.0.0 <= v <= 4.19.1.11 CVE

4.19.0.0 <= v <= 4.19.1.21 CVE

4.19.1.0 <= v <= 4.19.1.01 CVE

4.20.0.0 <= v <= 4.20.0.01 CVE

4.3.0 <= v <= 4.3.01 CVE

4.3.1 <= v <= 4.3.11 CVE

4.4.4 <= v <= 4.4.41 CVE

4.5.0 <= v < 4.16.1.11 CVE

4.5.0 <= v < 4.18.2.21 CVE

4.5.2 <= v <= 4.5.21 CVE

4.6.0 <= v <= 4.6.01 CVE

4.6.1 <= v <= 4.6.11 CVE

4.6.2 <= v <= 4.6.21 CVE

4.7.0 <= v < 4.18.2.41 CVE

4.7.0 <= v <= 4.7.01 CVE

4.8 <= v <= 4.81 CVE

4.9.0 <= v <= 4.9.01 CVE

4.9.1.0 <= v < 4.18.1.11 CVE

4.9.1.0 <= v <= 4.18.1.01 CVE

c8599040b4756034c7105806a53d2c99eb7ea0fe

3 CVEs

> 4.18.1.02 CVEs

4.18.2.12 CVEs

4.19.0.22 CVEs

4.20.2.02 CVEs

4dc3931233bafb748d5fe2c7e0f6f3499d76bc3a2 CVEs

616d72665f07f877fb6175e18cfe62d6372d5fd42 CVEs

ef5b5bbd4e545bb4e8bc87f878a21da40ba486e82 CVEs

> 4.18.2.21 CVE

> 4.18.2.31 CVE

> 4.18.2.41 CVE

> 4.19.1.01 CVE

> 4.19.1.11 CVE

> 4.19.1.21 CVE

07468f55a28af0d98b6fdb3d726762e8b5d1377f1 CVE

22baf2494d670afc0a87ef1eee40bd08223c58a31 CVE

4.13.1.01 CVE

4.16.1.01 CVE

4.16.1.11 CVE

4.18.2.21 CVE

4.18.2.31 CVE

4.18.2.51 CVE

4.19.1.01 CVE

4.19.1.11 CVE

4.19.1.31 CVE

4ea342cad3db3bb6cf4758000c9575d1675105bf1 CVE

71f47d61304d1a05627bc335c8d35d7ef1040fe11 CVE

84538da27c0173a8daa9cad93643802dfcf271d81 CVE

9f4c8959743d2f53faae6fc5d68e88ddc20e21a31 CVE

b2ffa3efa58a1569dbaa8a34f723756926e228201 CVE

be191f5ad79a77a54d5325307c6047fc352c275e1 CVE

cad9332082a1f85eedc30cf547ae28224be170c21 CVE

ebfdef57778ef7b59046b7cf2b5da6c7ee5c40c91 CVE