HighCVSS 7.8
EPSS 0.37%
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.
Technology
Cloud Platforms vulnerabilities
Public cloud services and their SDKs/agents (AWS, Azure, Google Cloud). 1,417 published CVES affecting Cloud Platforms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 1,417
- Critical
- 242
- High
- 530
- Medium
- 447
- Low
- 33
- Unscored
- 165
- CISA KEV
- 8
Latest Cloud Platforms CVEs
Newest publication first · page 27 of 40 · showing the latest 1,000
-
-
CriticalCVSS 9.8 EPSS 2.5%
Azure Networking Elevation of Privilege Vulnerability
-
CriticalCVSS 9.0 EPSS 0.64%
Azure Bot Service Elevation of Privilege Vulnerability
-
HighCVSS 7.5 EPSS 0.36%
Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes during connection initialization. When a client initiates an HTTPS connection, the server performs the SSL handshake before assigning the conne...
-
HighCVSS 7.7
Sending AWS chunk data with no Content-Length HTTP header causes the panic, every time. Reproduction Setup versity server running on port 7071, no SSL (for ease of packet tracing with tshark). Problem can be reproduced with or without SSL on the versity end. Use nginx to reverse...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (469c5e69f2b343a59f385bcbf2cbc4ff0fa7a0b0790a341b9bd07f3990c2ca84) Before creating the boto3 client, package exfiltrates user's credentials. Packages from the campaign are used as dependency in a GitHub project...
-
Unknown
-= Per source details. Do not edit below this line.=-
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (9bcbc4cde02af001776bd6812c42586311baa3d29fc13a5800760297af961041) Package acts as dependency that exfiltrates credentials data while creating a boto3 client Category: MALICIOUS - The campaign has clearly malici...
-
CVE-2025-9118 Dataform Path Traversal
PublishedCriticalCVSS 10.0 EPSS 0.68%A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.
-
MediumCVSS 6.5 EPSS 0.88%
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
-
CriticalCVSS 9.8 EPSS 0.61%
GenX_FX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentication tokens may be exposed if environment variables are misconfigured. Unauthorized users could gain access to cloud reso...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (d673b2612401a11ff219f59a9ca15986b4ce10d098f08d4beb5fbc9dc79ec554) This one package is clearly created as part of the campaign, but the malicious code from the previous version has been removed (no other changes...
-
MediumCVSS 5.3 EPSS 0.29%
We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port wher...
-
HighCVSS 7.5 EPSS 1.4%
Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.
-
MediumCVSS 5.5 EPSS 0.49%
Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
-
HighCVSS 7.8 EPSS 0.31%
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (2281f18809744cd511d94170c1ce172994a633aa0b8b5bc9fa9b892629b5d674) Before creating the boto3 client, package exfiltrates user's credentials. Packages from the campaign are used as dependency in a GitHub project...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (82e411db1ea78935340bd950942b13579b400264ddef042aa0b07d6952401c45) Package for enumeratin IAM Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-aws-enumerate R...
-
CriticalCVSS 10.0 EPSS 1.2%
Azure OpenAI Elevation of Privilege Vulnerability
-
CriticalCVSS 9.1 EPSS 0.89%
Azure Portal Elevation of Privilege Vulnerability
-
HighCVSS 7.1 EPSS 0.25%
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and rece...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (ddd759ada90b89401904e23b4e8cbe6a3021baf3c34495150b4a713ca7063be0) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (8c83e1a14cfb125b4cfcb3e1ca52afd31fb170b78ade2aa3fd31cc846b8ac7da) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (b0340aadb507418f2d21cfa7d568f133db23a6392a2ec64411540ec4ce5456d7) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
-
Unknown
-= Per source details. Do not edit below this line.=- Source: kam193 (be0304806895d9de6cc08d6e969b20baa9be9a8fb1aae813254eb58de6b7212c) If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens Category: MALICIOUS - The campai...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.