Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Jun 26, 2025When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address.CVE-2024-6174 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writCVE-2024-11584 · Other software · Canonical · reported by security@ubuntu.comMedium 5.9
cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2023Sensitive data could be exposed in logs of cloud-init before version 23.1.2.CVE-2023-1786 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Apr 19, 2023Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported.CVE-2022-2084 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/CVE-2021-3429 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2020cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit CVE-2020-11933 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
- Product
- snapd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netubuntu.com
Feb 5, 2020In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to gCVE-2020-8632 · Other software · Canonical · reported by MITREMedium 5.5
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
- Product
- Cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.launchpad.net
Feb 5, 2020cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudiniCVE-2020-8631 · Other software · Canonical · reported by MITREMedium 5.5
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
- Product
- Cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.launchpad.net
Nov 25, 2019An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.CVE-2012-6639 · Other software · cloud-init · reported by Red HatHigh 8.8
An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Apr 8, 2019A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH KeypCVE-2019-0816 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.1
A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
- Product
- Ubuntu Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgportal.msrc.microsoft.com
Mar 25, 2019In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.CVE-2017-7510 · Other software · [UNKNOWN] · reported by Red HatHigh 8.8
In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.
- Product
- RHV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Aug 1, 2018The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys.CVE-2018-10896 · Other software · Canonical · reported by Red HatHigh 7.1
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.