Read the docs

kubevirt

Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

kubevirt records in CISA KEV

No kubevirt vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Kubevirt 18 records HIGH Containerized-data-importer 1 record LOW Containerized Data Importer 1 record LOW

Records

20 records

TI-2022-01664 CVE-2022-1798

Path Traversal vulnerability in Kubevirt

Priority HIGH 71

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or whic…

CVSS 3.1HIGH 8.7 Local Low privileges No interaction EPSS 0.00376 Published 2022-09-15 Fixed in 0.55.1, 0.56.0 CWE-20
TI-2025-39846 CVE-2025-64433 · GHSA-qw6q-3pgr-5cwq

KubeVirt Arbitrary Container File Read

Priority MEDIUM 62

KubeVirt is a virtual machine management add-on for Kubernetes.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0052 Published 2025-11-07 Partial fix · 1.5.3, 1.6.1 CWE-22
TI-2020-11187 CVE-2020-14316 · GHSA-828r-r2c8-rfw3

Improper privilege management in kubevirt

Priority MEDIUM 46

A flaw was found in kubevirt 0.29 and earlier.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01576 Published 2020-07-29 Partial fix · 0.30.0 CWE-269
TI-2019-02853 CVE-2019-3841 · GHSA-3685-xxgw-jp8h

Improper certificate validation in kubevirt/virt-cdi-importer

Priority LOW 33

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries.

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.00531 Published 2019-03-25 No fix listed CWE-295
TI-2019-07496 CVE-2019-10175 · GHSA-x7rm-228h-8xh9

Information disclosure in kubevirt containerized-data-importer

Priority LOW 31

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume C…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0095 Published 2019-06-28 No fix listed CWE-200
TI-2020-01648 CVE-2020-1701 · GHSA-849r-8wvp-4wwg

Incorrect permission assignment in virt-handler

Priority LOW 30

A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00746 Published 2021-05-27 Partial fix · 0.26.0 CWE-732
Open these records in search →