How many CVEs does Cloud Foundry have?

Cloud Foundry has 178 published CVE records since 2016, including 32 in the last two years.

How many Cloud Foundry CVEs are in CISA KEV?

None of Cloud Foundry's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Cloud Foundry products have the most CVEs?

The Cloud Foundry products with the most published CVEs are UAA, cf-deployment, cf-release, CAPI-release, org.cloudfoundry.identity:cloudfoundry-identity-server.

What are the most common weakness types in Cloud Foundry CVEs?

Cloud Foundry's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-532 (Insertion of Sensitive Information into Log File), CWE-269 (Improper Privilege Management), CWE-20 (Improper Input Validation).

How many critical Cloud Foundry vulnerabilities are there?

Cloud Foundry has 21 critical and 98 high-severity CVEs.

What is the average severity of Cloud Foundry CVEs?

The average CVSS base score across Cloud Foundry's scored CVEs is 7.5.

Cloud Foundry Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Cloud Foundry vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

Cloud Foundry has 178 published CVE records since 2016, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

Security scorecard

A quick read on Cloud Foundry's vulnerability posture, as a share of its 178 published CVEs.

Average CVSS: 7.5
Critical / high: 67%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 74%

Severity and exploitation

How the CVSS severity of Cloud Foundry's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical21

High98

Medium58

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Cloud Foundry's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No Cloud Foundry CVEs currently have a tracked public exploit.

Most affected products

The Cloud Foundry products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Cloud Foundry CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Cloud Foundry CVE records.

Disclosure activity by year

How many Cloud Foundry CVEs were published each year.

2019

29

2020

11

2021

4

2022

2

2023

6

2024

4

2025

Latest Cloud Foundry CVEs

The most recently disclosed vulnerabilities affecting Cloud Foundry.

Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
CWE-345
Medium · CVSS 6.5
EPSS 0.2%2026-10-06
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
CWE-287
High · CVSS 7.6
EPSS 0.3%2026-10-06
Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
CWE-284
Critical · CVSS 9.2
EPSS 0.3%2026-09-11
BOSH vSphere CPI Improper Cert Validation

Other vendors

CVE counts for other vendors.

Arm180 CVEs WatchGuard180 CVEs wolfssl179 CVEs DrayTek177 CVEs dedecms177 CVEs MyBB177 CVEs OpenHarmony177 CVEs Sophos176 CVEs

Browse all vendors

Frequently asked questions

Common questions about Cloud Foundry vulnerabilities.

How many CVEs does Cloud Foundry have?: Cloud Foundry has 178 published CVE records since 2016, including 32 in the last two years.
How many Cloud Foundry CVEs are in CISA KEV?: None of Cloud Foundry's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Cloud Foundry products have the most CVEs?: The Cloud Foundry products with the most published CVEs are UAA, cf-deployment, cf-release, CAPI-release, org.cloudfoundry.identity:cloudfoundry-identity-server.
What are the most common weakness types in Cloud Foundry CVEs?: Cloud Foundry's CVEs most often map to these CWE weakness types: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-532 (Insertion of Sensitive Information into Log File), CWE-269 (Improper Privilege Management), CWE-20 (Improper Input Validation).
Are there public exploits for Cloud Foundry vulnerabilities?: No Cloud Foundry CVEs currently have a tracked public exploit in this dataset.
How many critical Cloud Foundry vulnerabilities are there?: Cloud Foundry has 21 critical and 98 high-severity CVEs.
What is the average severity of Cloud Foundry CVEs?: The average CVSS base score across Cloud Foundry's scored CVEs is 7.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.