https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:46:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-358996 EUVD-2026-358996 https://cve.radiocsirt.org/vuln/euvd-2026-358996 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50222 <p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack&#39;s Userdata reference APIs.</p> <p>Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p> <p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> <p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack&#39;s Userdata reference APIs.</p> <p>Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p> <p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50222 https://cve.radiocsirt.org/vuln/ghsa-h5gh-c77h-9ppf <p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack&#39;s Userdata reference APIs.</p> <p>Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p> <p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> <p>Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack&#39;s Userdata reference APIs.</p> <p>Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine, deployVirtualMachine, and updateVirtualMachine, exhibit missing or insufficient access control validation, potentially allowing cross-tenant/cross-account access to userdata resources that belong to other tenants.</p> <p>This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>The deleteCniConfiguration API, introduced in 4.21.0.0, also exhibits similar behaviour and lacks access validation.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-h5gh-c77h-9ppf https://cve.radiocsirt.org/vuln/ncsc-2026-0332 NCSC-2026-0332 https://cve.radiocsirt.org/vuln/ncsc-2026-0332 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2962 <p>Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2962