Cloudforms vulnerabilitiesAnd the versions its exploited flaws hit.
Cloudforms is made by Red Hat. We track 48 published vulnerabilities listed under that exact name, across 23 versions. 1 of them is on the list of flaws known to be exploited, the newest added on 7 July 2025. Red Hat lists newer releases under their own names, such as Cloudforms Management Engine, so check those pages too.
The most recent Cloudforms flaw added to the known-exploited list is CVE-2019-5418, on 7 July 2025. We keep watching the known-exploited list.
Is Cloudforms listed under other names? Yes.
Red Hat also lists Cloudforms under more specific names, such as Cloudforms Management Engine and Cloudforms 3.0 Management Engine. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
- Cloudforms Management Engine42 published vulnerabilities
- Cloudforms 3.0 Management Engine13 published vulnerabilities
- Cloudforms 3.0.3 Management Engine2 published vulnerabilities
- Cloudforms 3.0.4 Management Engine2 published vulnerabilities
- Cloudforms 3.0.1 Management Engine2 published vulnerabilities
- Cloudforms 3.1 Management Engine2 published vulnerabilities
- Cloudforms Cloud Engine2 published vulnerabilities
- Cloudforms 3.0.5 Management Engine2 published vulnerabilities
- Cloudforms 3.0.2 Management Engine2 published vulnerabilities
Which versions of Cloudforms do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2019-5418Exploited list, 7 Jul 2025
Rails Ruby on Rails Path Traversal Vulnerability
4.64.7
Which Cloudforms vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.5Rails Ruby on Rails Path Traversal Vulnerability
Rails Ruby on Rails contains a path traversal vulnerability in Action View.
Which Cloudforms flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 87%CVE-2017-11610High
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to...
- 87%CVE-2019-11358Medium
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
- 27%CVE-2018-7750Critical
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly...
- 27%CVE-2018-3760High
There is an information leak vulnerability in Sprockets.
- 13%CVE-2018-1058High
A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.
- 5.9%CVE-2016-5402High
A code injection flaw was found in the way capacity and utilization imported control files are processed.
- 4.4%CVE-2018-1000544Critical
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem.
- 4.0%CVE-2014-0081Medium
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to...
Running Cloudforms? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.
- Matched to
- Cloudforms on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 48 published vulnerabilities listed under the name Cloudforms, across 23 versions. The most recent Cloudforms flaw added to the known-exploited list is CVE-2019-5418, on 7 July 2025.
1 is on the list of flaws known to be exploited. The most recently added is CVE-2019-5418.
Red Hat also lists Cloudforms under more specific names, such as Cloudforms Management Engine and Cloudforms 3.0 Management Engine. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2019-5418, affects 4.6, 4.7. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Cloudforms. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.