Cloud & SaaS
13,315 CVEs tracked since 1999. In the last 12 months, 3,876, +195% on the 12 before.
Cloud & SaaS by subsector, Oct 2026 so far
- SaaS applications21136% · 37 vendors
- Container orchestration17530% · 16 vendors
- Cloud platforms9115% · 16 vendors
- Virtualization569% · 9 vendors
- API gateways325% · 9 vendors
- Not yet sub-classified27The tagger has not placed these yet
Month by month
Every monthly snapshot of Cloud & SaaS. A column is the CVEs published that month.
| Month | CVEs |
|---|---|
| 2021-10 | 55 |
| 2021-11 | 51 |
| 2021-12 | 50 |
| 2022-01 | 65 |
| 2022-02 | 65 |
| 2022-03 | 105 |
| 2022-04 | 83 |
| 2022-05 | 73 |
| 2022-06 | 96 |
| 2022-07 | 99 |
| 2022-08 | 76 |
| 2022-09 | 76 |
| 2022-10 | 84 |
| 2022-11 | 120 |
| 2022-12 | 75 |
| 2023-01 | 71 |
| 2023-02 | 68 |
| 2023-03 | 0 |
| 2023-04 | 87 |
| 2023-05 | 86 |
| 2023-06 | 80 |
| 2023-07 | 108 |
| 2023-08 | 129 |
| 2023-09 | 74 |
| 2023-10 | 87 |
| 2023-11 | 131 |
| 2023-12 | 84 |
| 2024-01 | 123 |
| 2024-02 | 59 |
| 2024-03 | 96 |
| 2024-04 | 129 |
| 2024-05 | 96 |
| 2024-06 | 94 |
| 2024-07 | 122 |
| 2024-08 | 64 |
| 2024-09 | 112 |
| 2024-10 | 82 |
| 2024-11 | 146 |
| 2024-12 | 89 |
| 2025-01 | 104 |
| 2025-02 | 99 |
| 2025-03 | 78 |
| 2025-04 | 137 |
| 2025-05 | 115 |
| 2025-06 | 121 |
| 2025-07 | 97 |
| 2025-08 | 113 |
| 2025-09 | 135 |
| 2025-10 | 78 |
| 2025-11 | 122 |
| 2025-12 | 172 |
| 2026-01 | 140 |
| 2026-02 | 155 |
| 2026-03 | 254 |
| 2026-04 | 216 |
| 2026-05 | 400 |
| 2026-06 | 402 |
| 2026-07 | 484 |
| 2026-08 | 869 |
| 2026-09 | 584 |
| 2026-10 | 592 |
Vendors
Who shipped the most Cloud & SaaS CVEs in Oct 2026 so far, with their rank across all vendors.
Weaknesses
The weakness classes behind Cloud & SaaS CVEs in Oct 2026 so far.
Latest CVEs
The 15 most recently published vulnerabilities in Cloud & SaaS.
- CVE-2026-115455Gcc: stack overflow in std::bitset on libstdc++6.5
- CVE-2026-114691Gcc: integer wrap in `std5.9
- CVE-2026-114690Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std6.2
- CVE-2026-118593Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)5.9
- CVE-2026-107239A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center ...—
- CVE-2026-107238A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Coll...—
- CVE-2023-22793A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft Sys...—
- CVE-2026-13303Boundary vulnerable to server-side request forgery in Vault credential store8.7
- CVE-2026-92092Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification7.4
- CVE-2026-119168Nomad allocation data migration may allow host directory permission modification via symlink following8.8
- CVE-2026-107347Nomad dispatch payload writes can escape the allocation directory through symlinks8.4
- CVE-2026-102260Nomad vulnerable to cross-namespace information disclosure in multiple endpoints4.3
- CVE-2026-118761Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory7.5
- CVE-2026-119115Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes8.5
- CVE-2026-118760Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads6.5
The record
- Busiest month
- Aug 2026, 869 CVEs
- Oct 2026 so far
- 592 CVEs from 94 vendors
- Deployment
- Mixed, 72%
- Monthly snapshots
- 269 since 1999
Is your business exposed to threats like these?
Discuss a security assessment of your internet-facing systems. Scope, price and timing agreed before testing.
Request an assessment