TI-2026-11369 CVE-2026-13434 · GHSA-9fjc-whw6-cqfc
Improper input validation in Red Hat OpenShift Virtualization 4
Priority LOW 22
A flaw was found in KubeVirt's network annotation generator.
Vulnerabilities
12 records
TI-2026-11287 CVE-2026-13322 · GHSA-6f2p-2qg2-qqch
Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
Priority LOW 17
A flaw was found in KubeVirt's downward metrics virtio-serial server.
TI-2026-11284 CVE-2026-13318 · GHSA-cgm6-wvp9-4g5h
Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
Priority LOW 28
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler.
TI-2026-11224 CVE-2026-13218 · GHSA-q3jc-42cq-33fj
Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
Priority LOW 19
A flaw was found in KubeVirt's virt-handler network cache handling.
TI-2026-11215 CVE-2026-13208 · GHSA-72r2-m3hg-cvf5
Improper authentication in Red Hat OpenShift Virtualization 4
Priority LOW 28
A flaw was found in KubeVirt's virt-handler domain notify server.
TI-2026-11209 CVE-2026-13201 · GHSA-rcfc-7m3g-h5xh
Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler…
Priority LOW 32
A flaw was found in KubeVirt's safepath package used by virt-handler.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3
The HTTP/2 protocol allows a denial of service (server resource consumption) because…
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Priority LOW 30
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler.
TI-2020-11187 CVE-2020-14316 · GHSA-828r-r2c8-rfw3
Improper privilege management in kubevirt
Priority MEDIUM 46
A flaw was found in kubevirt 0.29 and earlier.