Skip to content

Technology

Cloud Platforms vulnerabilities

Public cloud services and their SDKs/agents (AWS, Azure, Google Cloud). 1,417 published CVES affecting Cloud Platforms, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1,417
Critical
242
High
530
Medium
447
Low
33
Unscored
165
CISA KEV
8
Atom feed of Cloud Platforms alerts

Latest Cloud Platforms CVEs

Newest publication first · page 31 of 40 · showing the latest 1,000

  3. CVE-2025-1974 ingress-nginx admission controller RCE escalation

    Published
    CriticalCVSS 9.8 EPSS 99.4% Public exploit

    A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the c...

  4. GHSA-5pq3-h73f-66hr AWS CDK CodePipeline: trusted entities are too broad

    Published
    LowCVSS 3.8

    Summary The AWS Cloud Development Kit (CDK) is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during deployment to a user's AWS account. AWS CDK contains pre...

  6. CVE-2024-12392 Server-Side Request Forgery (SSRF) in binary-husky/gpt_academic

    Published
    MediumCVSS 6.5 EPSS 0.61%

    A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functionality to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this vulnerability to make the applicat...

  8. CVE-2024-8952 SSRF in composiohq/composio

    Published
    HighCVSS 7.5 EPSS 0.73%

    A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local ser...

  9. CVE-2024-12376 Server Side Request Forgery in lm-sys/fastchat

    Published
    HighCVSS 7.5 EPSS 0.76%

    A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS m...

  10. CVE-2024-11603 Server-Side Request Forgery in lm-sys/fastchat

    Published
    HighCVSS 7.5 EPSS 0.70%

    A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the /queue/join? endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized a...

  11. CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

    Published
    HighCVSS 7.5 EPSS 0.61%

    langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized acc...

  12. CVE-2024-12068 Server-Side Request Forgery in haotian-liu/llava

    Published
    HighCVSS 7.5 EPSS 0.70%

    A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible fr...

  13. CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava

    Published
    HighCVSS 7.5 EPSS 0.70%

    A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint. An attacker can gain unauthorized access to internal networks or the AWS metadata endpoint by sending crafted requests that exploit insu...

  19. CVE-2024-13862 S3Bubble Media Streaming <= 8.0 - Reflected XSS

    Published
    HighCVSS 7.1 EPSS 0.27%

    The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such...

  24. CVE-2024-55581 When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certifica...

    Published
    HighCVSS 7.4 EPSS 0.29%

    When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration).

  25. MAL-2025-6583 Malicious code in serverkeeper-verifier (PyPI)

    Published
    Unknown

    -= Per source details. Do not edit below this line.=- Source: kam193 (62ec235d314e175928f82504dade8d7f8313bc88707038976e5be6d78709b869) This campaign is built from two parts: packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date"...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.