CVE Tools
Track your stack

Cloud-foundry-foundation

10 CVEs tracked since 2017. Since Oct 2017, none of them reached CISA KEV.

Cloud-foundry-foundation CVEs per month

Oct 2017 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Cloud-foundry-foundation CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2017-1020
2017-11no snapshot
2017-121 or fewer
2018-012 or fewer
2018-021 or fewer
2018-032 or fewer
2018-04no snapshot
2018-05no snapshot
2018-062 or fewer
2018-072 or fewer
2018-082 or fewer
2018-092 or fewer
2018-102 or fewer
2018-11no snapshot
2018-122 or fewer
2019-01no snapshot
2019-021 or fewer
2019-03no snapshot
2019-04no snapshot
2019-051 or fewer
2019-06no snapshot
2019-072 or fewer
2019-082 or fewer
2019-092 or fewer
2019-102 or fewer
2019-112 or fewer
2019-122 or fewer
2020-012 or fewer
2020-022 or fewer
2020-032 or fewer
2020-04no snapshot
2020-05no snapshot
2020-062 or fewer
2020-07no snapshot
2020-082 or fewer
2020-091 or fewer
2020-101 or fewer
2020-111 or fewer
2020-122 or fewer
2021-012 or fewer
2021-022 or fewer
2021-03no snapshot
2021-042 or fewer
2021-052 or fewer
2021-062 or fewer
2021-072 or fewer
2021-083 or fewer
2021-092 or fewer
2021-102 or fewer
2021-112 or fewer
2021-122 or fewer
2022-012 or fewer
2022-022 or fewer
2022-033 or fewer
2022-043 or fewer
2022-053 or fewer
2022-063 or fewer
2022-073 or fewer
2022-083 or fewer
2022-093 or fewer
2022-102 or fewer
2022-113 or fewer
2022-123 or fewer
2023-013 or fewer
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-0680
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-1011 or fewer
2026-113 or fewer

Products

The products that kept showing up in Cloud-foundry-foundation's monthly top three, with their CVEs summed over those months.

  1. Bosh31 month
  2. Cf Deployment21 month
  3. Bpm-release11 month
  4. Cloud Foundry Runtime Cf-release11 month
  5. Elastic Runtime11 month
  6. Pivotal Cloud Foundry Elastic Runtime11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Cloud-foundry-foundation.

  1. CVE-2026-59388Cloud Controller exposes secrets in audit log6.5
  2. CVE-2026-47839Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin—
  3. CVE-2026-47827CVE-2026-47827 – BOSH CLI Powershell Injection7.5
  4. CVE-2026-47831Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks7.5
  5. CVE-2026-47830Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite8.8
  6. CVE-2026-47833setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to chown an arbitrary...6.1
  7. CVE-2026-41010ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim fr...8.2
  8. CVE-2026-41011PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the up...8.2
  9. CVE-2026-41858Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a...7.5
  10. CVE-2026-41859A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into ...7.8
  11. CVE-2026-41860CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. HttpRequestHelper#create_async_endpoint and #send_http_get_request_synchronous hard-...8.8
  12. CVE-2026-40965Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadvertently exposed t...10.0
  13. CVE-2026-40964Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and ...7.5
  14. CVE-2026-41704Compromised VM can make arbitrary blobstore deletes5.0
  15. CVE-2026-41009Local Blobstore may allow arbitrary reads/deletes5.8

The record

Peak rank
#143 in Oct 2017
Busiest month shown
Jun 2026, 8 CVEs
Months with a KEV entry
0 since Oct 2017
Monthly snapshots
2 since 2017
Cloud-foundry-foundation's full record, month by month