CVE-2026-65613

MediumCVSS 4.3/10Last modified Oct 16, 2026

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2026
Last modified
Oct 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-656168.8Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.CVE-2026-656178.8A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, andCVE-2026-656186.5Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog CVE-2026-65627.3A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. ExecuCVE-2026-656238.7Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion duringCVE-2026-656246.9Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust CVE-2026-65638.8A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goforCVE-2026-656337.6Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credenCVE-2026-656348.2Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denialCVE-2026-656358.3Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenCVE-2026-656362.1Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary contenCVE-2026-656379.8Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from
CVE-2026-65613: Medium severity, CVSS 4.3 | Vulnix