Red Hat / Openshift Virtualization
11 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-13434 | Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is… | MEDIUM | 4.9 | Jun 26, 2026 |
| CVE-2026-13322 | Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service | LOW | 3.8 | Jun 26, 2026 |
| CVE-2026-13318 | Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip | MEDIUM | 6.4 | Jun 25, 2026 |
| CVE-2026-13218 | Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher | MEDIUM | 4.2 | Jun 25, 2026 |
| CVE-2026-13208 | Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body | MEDIUM | 6.5 | Jun 24, 2026 |
| CVE-2026-13201 | Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption | HIGH | 7.3 | Jun 24, 2026 |
| CVE-2026-44495 | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge | HIGH | 7.7 | Jun 11, 2026 |
| CVE-2023-48795 | ssh: Prefix truncation attack on Binary Packet Protocol (BPP) | MEDIUM | 5.9 | Dec 18, 2023 |
| CVE-2023-44487 KEV | HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) | MEDIUM | 6.9 | Oct 10, 2023 |
| CVE-2020-1742 | nmstate/kubernetes-nmstate-handler: /etc/passwd is given incorrect privileges | HIGH | 7.0 | Jun 7, 2021 |
| CVE-2020-14316 | kubevirt: VMIs can be used to access host files | CRITICAL | 9.9 | Jul 29, 2020 |
Showing 1 to 11 of 11 CVEs