How many CVEs does Cloud Foundry have?

Cloud Foundry has 175 published CVE records since 2016, including 29 in the last two years.

How many Cloud Foundry CVEs are in CISA KEV?

None of Cloud Foundry's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Cloud Foundry products have the most CVEs?

The Cloud Foundry products with the most published CVEs are UAA, cf-release, cf-deployment, CAPI-release, org.cloudfoundry.identity:cloudfoundry-identity-server.

What are the most common weakness types in Cloud Foundry CVEs?

Cloud Foundry's CVEs most often map to these CWE weakness types: CWE-532 (Insertion of Sensitive Information into Log File), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-400 (Uncontrolled Resource Consumption), CWE-295 (Improper Certificate Validation).

How many critical Cloud Foundry vulnerabilities are there?

Cloud Foundry has 20 critical and 97 high-severity CVEs.

What is the average severity of Cloud Foundry CVEs?

The average CVSS base score across Cloud Foundry's scored CVEs is 7.5.

Cloud Foundry Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Cloud Foundry vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Cloud Foundry has 175 published CVE records since 2016, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Cloud Foundry products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Cloud Foundry's vulnerability posture, as a share of its 175 published CVEs.

Average CVSS: 7.5
Critical / high: 67%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 76%

Severity and exploitation

How the CVSS severity of Cloud Foundry's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical20

High97

Medium57

Low1

In CISA’s Known Exploited Vulnerabilities catalog

None of Cloud Foundry's CVEs are currently listed in CISA's KEV catalog.

Public exploits

No Cloud Foundry CVEs currently have a tracked public exploit.

Most affected products

The Cloud Foundry products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Cloud Foundry CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Cloud Foundry CVE records.

Disclosure activity by year

How many Cloud Foundry CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest Cloud Foundry CVEs

The most recently disclosed vulnerabilities affecting Cloud Foundry.

BOSH vSphere CPI Improper Cert Validation
CWE-295
High · CVSS 7.7
EPSS 0.1%2026-08-29
Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
CWE-178
High · CVSS 8.7
EPSS 0.3%2026-08-25
CVE-2026-47827 – BOSH CLI Powershell Injection
CWE-77
High · CVSS 7.5
EPSS 1.2%2026-08-21
Arbitrary Root File Write via Path Traversal in BOSH agent

Other vendors

Browse vulnerabilities for other tracked vendors.

DrayTek177 CVEs MyBB177 CVEs OpenHarmony177 CVEs owncloud176 CVEs dedecms176 CVEs Kashipara176 CVEs Sophos175 CVEs XnView174 CVEs

Browse all vendors

Frequently asked questions

Common questions about Cloud Foundry vulnerabilities.

How many CVEs does Cloud Foundry have?: Cloud Foundry has 175 published CVE records since 2016, including 29 in the last two years.
How many Cloud Foundry CVEs are in CISA KEV?: None of Cloud Foundry's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Cloud Foundry products have the most CVEs?: The Cloud Foundry products with the most published CVEs are UAA, cf-release, cf-deployment, CAPI-release, org.cloudfoundry.identity:cloudfoundry-identity-server.
What are the most common weakness types in Cloud Foundry CVEs?: Cloud Foundry's CVEs most often map to these CWE weakness types: CWE-532 (Insertion of Sensitive Information into Log File), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-400 (Uncontrolled Resource Consumption), CWE-295 (Improper Certificate Validation).
Are there public exploits for Cloud Foundry vulnerabilities?: No Cloud Foundry CVEs currently have a tracked public exploit in this dataset.
How many critical Cloud Foundry vulnerabilities are there?: Cloud Foundry has 20 critical and 97 high-severity CVEs.
What is the average severity of Cloud Foundry CVEs?: The average CVSS base score across Cloud Foundry's scored CVEs is 7.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Cloud Foundry vulnerabilities

Monitor new Cloud Foundry vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing