CVE-2026-47359

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...

CVE-2026-50112

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-74515

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine s390 PCI component. This vulnerability arises from improper handling of adapter interrupt forwarding, where enabling it multiple times for a zPCI device without prior unregistration can lead to resource overwriting and leakag...

CVE-2026-74568

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 systems, specifically within the virtual Generic Interrupt Controller VGIC. A race condition can occur when a Logical Processor Interrupt LPI is released and then re-registered with the same identifier by a guest...

CVE-2026-47359

Apache CloudStack is vulnerable to an OS Command Injection in its NAS backup provider plugin . The addBackupRepository (available since 4.20.0.0) and updateBackupRepository (introduced in 4.22.0.0) APIs accept unsanitized command options for the backup repository. A malicious operator account can...

CVE-2026-47359 Apache CloudStack: OS Command Injection due to unsanitized mount command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...

EUVD-2026-63848

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...

CVE-2026-47359 Apache CloudStack: OS Command Injection due to unsanitized mount command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...

CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-50112

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

EUVD-2026-63847

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...

CVE-2026-74517

A flaw was found in KVM Kernel-based Virtual Machine. This vulnerability occurs when the system attempts to process a delayed I/O APIC End-of-Interrupt EOI after the associated virtual CPUs vCPUs have been destroyed. This timing issue results in a Use-After-Free UAF condition, where the system...

SUSE CVE-2026-72277

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

SUSE CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

SUSE CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

SUSE CVE-2026-72288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's ...

SUSE CVE-2026-72289

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgicpruneaplist drops both aplistlock and irqlock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity ...

PT-2026-79316

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.14.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An authenticated tenant can perform Server-Side Request Forgery SSRF by registering a template that points to a malicious...

PT-2026-79315

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An OS Command Injection issue exists in the NAS backup provider plugin. The 'addBackupRepository' and 'updateBackupRepository...