Most recent entries from all

EUVD-2026-271197

2026-10-18T14:12:42.411765+00:00

EUVD-2026-271197

fkie_cve-2025-59302

2026-10-18T14:12:42.411802+00:00

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

* quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage

This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

GHSA-hgmv-qpw9-xrfq

2026-10-18T14:12:42.411851+00:00

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

* quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage

This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

WID-SEC-W-2025-2687 — Apache CloudStack: Mehrere Schwachstellen

2026-10-18T14:12:42.411878+00:00

Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode auszuführen, und um Informationen offenzulegen.