# Apache Cloudstack


- [CVE-2012-4501](https://insights.sbomify.com/CVE-2012-4501/): Missing authorization in n/a (critical 10.0)
- [CVE-2024-38346](https://insights.sbomify.com/CVE-2024-38346/): Apache CloudStack: Unauthenticated cluster service port leads to remote execution (critical 9.8)
- [CVE-2024-39864](https://insights.sbomify.com/CVE-2024-39864/): Apache CloudStack: Integration API service uses dynamic port when disabled (critical 9.8)
- [CVE-2024-29006](https://insights.sbomify.com/CVE-2024-29006/): Apache CloudStack: x-forwarded-for HTTP header parsed by default (critical 9.8)
- [CVE-2022-35741](https://insights.sbomify.com/CVE-2022-35741/): Apache CloudStack SAML Single Sign-On XXE (critical 9.8)
- [CVE-2019-17562](https://insights.sbomify.com/CVE-2019-17562/): Command injection in Apache CloudStack (critical 9.8)
- [CVE-2016-6813](https://insights.sbomify.com/CVE-2016-6813/): Missing authorization in Apache CloudStack (critical 9.8)
- [CVE-2015-3252](https://insights.sbomify.com/CVE-2015-3252/): Information disclosure in n/a (critical 9.8)
- [CVE-2026-59085](https://insights.sbomify.com/CVE-2026-59085/): Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module (critical 9.1)
- [CVE-2026-61398](https://insights.sbomify.com/CVE-2026-61398/): Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI (critical 9.1)
- [CVE-2026-62440](https://insights.sbomify.com/CVE-2026-62440/): Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation (critical 9.1)
- [CVE-2026-25199](https://insights.sbomify.com/CVE-2026-25199/): Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/cloudstack/