CVE-2013-6398

CVE-2013-6398 affects Apache CloudStack virtual routers prior to 4.2.1. After a restart, firewall rules’ source restrictions were not preserved, allowing a remote attacker to bypass restrictions and access network resources. Public sources in connected documents (NVD entry and security advisories...

CVE-2026-66721

Apache CloudStack versions 4.12.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to a missing authorization issue in the listHostTags API. While Domain Admins are permitted to call this API, it fails to apply domain scoping, returning host tags for every host in the entire enviro...