| Tenable (Nessus) [TOP 30] |
CVES |
TIME |
TITLE |
URL |
| 046ffb0144a75bc73e47e8a5f217209b |
CVE-2026-66797 |
2026-08-21 09:16:40  |
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user write annotations to, and disclose existing annotations/comments on, an entity they don't own by simply supplying its UUID. This issue affects Apache CloudStack: from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| 85e3508afcbdabed6abf157c609c01af |
CVE-2026-66721 |
2026-08-21 09:16:40 |
Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| d7e5497781f1f0a72be6ef52e6f107b7 |
CVE-2026-65613 |
2026-08-21 09:16:40 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| 2dec29e2027e3e5d7370130732cb2084 |
CVE-2026-63046 |
2026-08-21 09:16:40 |
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve it. [1] https://github.com/apache/inlong/pull/12151 . [2] https://github.com/apache/inlong/pull/12155 . |
详情 |
| 5a979eb79cce72a16797eedd63e6a424 |
CVE-2026-62440 |
2026-08-21 09:16:39 |
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.22.1.1 or later, which fixes the issue. |
详情 |
| fa78cbcb5058f36eb24afb611363c713 |
CVE-2026-61400 |
2026-08-21 09:16:39 |
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router. The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| 78ad8b991193e993b7a81bb14d81f517 |
CVE-2026-61398 |
2026-08-21 09:16:39 |
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| a074fdf1fc8356964839230c9dd9e694 |
CVE-2026-61397 |
2026-08-21 09:16:39 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1, which fixes the issue. |
详情 |
| 5c226ab230fef11a943a04faa5ef4f71 |
CVE-2026-59799 |
2026-08-21 09:16:38 |
Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow. This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| f74ee4fbb1572392a9dc3f961f999dae |
CVE-2026-59655 |
2026-08-21 09:16:38 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue. |
详情 |
| 440ff79d3f0a0611f9df4b15e26c4bc8 |
CVE-2026-18917 |
2026-08-20 09:54:50 |
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. |
详情 |
| 0a52e9a997cb8f93bf0e1a1f41d96e48 |
CVE-2026-77014 |
2026-08-20 09:16:48 |
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB. |
详情 |
| 3aed10fddb7f89233f83cb424861e6f2 |
CVE-2026-76610 |
2026-08-20 09:16:48 |
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users. |
详情 |
| 3e158303c9df875c33f3c7fb76add164 |
CVE-2026-14953 |
2026-08-20 09:16:47 |
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php. |
详情 |
| 25015730ab9ab365c7f7c21ab5834c78 |
CVE-2026-14952 |
2026-08-20 09:16:47 |
An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users. |
详情 |
| 56cbc9a938c064095cc779bc7150c93f |
CVE-2026-14951 |
2026-08-20 09:16:47 |
An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages. |
详情 |
| 26a1510868a95f1fdcec8dc66e956be1 |
CVE-2026-14950 |
2026-08-20 09:16:47 |
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface. |
详情 |
| d059a44f86b3392547d5200612874d01 |
CVE-2026-14949 |
2026-08-20 09:16:47 |
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application. |
详情 |
| 76a6a6ba5b6f98c85d806f8aa60d5743 |
CVE-2026-14948 |
2026-08-20 09:16:47 |
A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives. |
详情 |
| 13d66b8c982c1b996b4c6664d80dc215 |
CVE-2026-14947 |
2026-08-20 09:16:46 |
A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise. |
详情 |
| f040d3ecd7b36d9bf036805a723e8475 |
CVE-2026-75981 |
2026-08-19 07:16:59 |
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real ![]() tag. remove_tags_from_output() only strips |