KU
Product
Kubevirt
18
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 13Low 1
Watch
Add Kubevirt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-14316 | 9.9 | Jul 29 | A flaw was found in kubevirt 0.29 and earlier Affected: through 0.29 |
| CVE-2023-26484 | 8.2 | Mar 15 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: through 0.59.0 |
| CVE-2025-64324 | 7.7 | Nov 18 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: before 1.6.1; 1.7.0; 1.7.0 |
| CVE-2026-13201 | 7.3 | Jun 24 | Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption Affected: All versions, or not specified |
| CVE-2026-13208 | 6.5 | Jun 24 | Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body Affected: All versions, or not specified |
| CVE-2025-64433 | 6.5 | Nov 7 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: before 1.5.3; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0 |
| CVE-2022-1798 | 6.5 | Sep 15 | A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host… Affected: 0.20.0 before 0.55.1 |
| CVE-2020-1701 | 6.5 | May 27 | A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler Affected: before 0.26.0 |
| CVE-2026-13318 | 6.4 | Jun 25 | Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip Affected: All versions, or not specified |
| CVE-2025-64434 | 6.3 | Nov 7 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: before 1.5.3; 1.6.0 |
| CVE-2024-33394 | 5.9 | May 2 | An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component Affected: through 1.2.0 |
| CVE-2025-64436 | 5.3 | Nov 7 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: through 1.5.3; 1.6.0 through 1.6.1 |
| CVE-2025-64435 | 5.3 | Nov 7 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: through 1.6.3; 1.7.0 |
| CVE-2025-64437 | 5.0 | Nov 7 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: before 1.5.3; 1.6.0 |
| CVE-2026-13434 | 4.9 | Jun 26 | Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled Affected: All versions, or not specified |
| CVE-2025-64432 | 4.7 | Nov 7 | KubeVirt is a virtual machine management add-on for Kubernetes Affected: before 1.5.3; 1.6.0; 1.6.0; 1.6.0 |
| CVE-2026-13218 | 4.2 | Jun 25 | Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher Affected: All versions, or not specified |
| CVE-2026-13322 | 3.8 | Jun 26 | Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service Affected: All versions, or not specified |
Showing 18