GCVE - cpe:2.3:a:opennebula:opennebula:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:opennebula:opennebula:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Opennebula (`5a54a4ea-aac5-57c3-95cf-12ba1f8cfae9`)
Product	Opennebula (`00396a2a-8965-5f37-aea8-a552d5fc6eaa`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-56537`	vulnerable	2026-06-08 07:33:15.653031	Details available A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter. Published: 2026-04-29T00:00:00.000Z Updated: 2026-04-29T16:21:27.264Z Open on db.gcve.eu Reference links https://opennebula.io/opennebula-7/ https://github.com/MarkArtamonov/OpenNebula-CVE-2025-56537	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56536`	vulnerable	2026-06-08 07:33:15.652804	Details available A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter. Published: 2026-04-29T00:00:00.000Z Updated: 2026-04-29T16:23:42.067Z Open on db.gcve.eu Reference links https://opennebula.io/opennebula-7/ https://github.com/MarkArtamonov/OpenNebula-CVE-2025-56536	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56535`	vulnerable	2026-06-08 07:33:15.652563	Details available A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter. Published: 2026-04-29T00:00:00.000Z Updated: 2026-04-29T16:25:48.166Z Open on db.gcve.eu Reference links https://opennebula.io/opennebula-7/ https://github.com/MarkArtamonov/OpenNebula-CVE-2025-56535	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-56534`	vulnerable	2026-06-08 07:33:15.652222	Details available A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Published: 2026-04-29T00:00:00.000Z Updated: 2026-04-29T16:24:39.575Z Open on db.gcve.eu Reference links https://opennebula.io/opennebula-7/ https://github.com/MarkArtamonov/OpenNebula-CVE-2025-56534	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-54955`	vulnerable	2026-06-08 07:33:13.828198	Details available HIGH (8.1) OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials. Published: 2025-08-02T00:00:00.000Z Updated: 2025-08-04T15:20:53.978Z Open on db.gcve.eu Reference links https://github.com/OpenNebula/one https://github.com/Stolichnayer/OpenNebula-Account-Takeover https://docs.opennebula.io/6.10/intro_release_notes/release_notes_enterprise/resolved_issues_6103.html https://github.com/OpenNebula/one/releases/tag/release-7.0.0 https://github.com/OpenNebula/one/commit/81058d9705e7ac619d294423de28b76d88f613b6	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Opennebula

Notes

PURL mappings

Vulnerability references

Contribute