https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:07:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357750 EUVD-2026-357750 https://cve.radiocsirt.org/vuln/euvd-2026-357750 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50112 <p>SSRF via Metalink Mirror URL Resolution:</p> <p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p> <p>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</p> <p>An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants&#39; VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.</p> <p>When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.</p> <p>These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> <p>SSRF via Metalink Mirror URL Resolution:</p> <p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p> <p>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</p> <p>An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants&#39; VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.</p> <p>When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.</p> <p>These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50112 https://cve.radiocsirt.org/vuln/ghsa-qh8m-g3r9-6vh2 <p>SSRF via Metalink Mirror URL Resolution:</p> <p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p> <p>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</p> <p>An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants&#39; VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.</p> <p>When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.</p> <p>These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> <p>SSRF via Metalink Mirror URL Resolution:</p> <p>An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs.</p> <p>RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads:</p> <p>An authenticated CloudStack tenant holding the default User role can execute arbitrary shell commands as root on the KVM hypervisor host that runs other tenants&#39; VMs. This is cross-tenant root on the underlying compute, reachable via the public CloudStack API.</p> <p>When a User registers a VM template with directDownload=true and a URL pointing to a .metalink file, the management server fetches the metalink XML and dispatches download to the KVM agent. Inner URLs inside the metalink XML are never re-validated against the scheme allowlist.</p> <p>These issues affect Apache CloudStack: from 4.14.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-qh8m-g3r9-6vh2 https://cve.radiocsirt.org/vuln/ncsc-2026-0332 NCSC-2026-0332 https://cve.radiocsirt.org/vuln/ncsc-2026-0332 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2962 <p>Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2962