Login Request a demo
TP
Product
Tekton Pipelines
by Linuxfoundation · last CVE Apr 21, 2026
8
CVEs
0
On KEV
9.6
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 1High 1Medium 6Low 0
Severity
All severities8Critical1High1Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Tekton Pipelines to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40924
6.5
0%
Apr 21
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
Affected: before 1.11.1
CVE-2026-40161
6.5
0%
Apr 21
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
Affected: 1.0.0 through 1.10.0
CVE-2026-25542
6.5
0%
Apr 21
Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
Affected: 0.43.0 before 1.11.0
CVE-2026-33022
6.5
0%
Mar 20
Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun
Affected: 0.60.0 before 1.0.1; 1.1.0 before 1.3.3; 1.4.0 before 1.6.1; 1.7.0 before 1.9.2; 1.10.0 before 1.10.2
CVE-2026-40923
5.4
0%
Apr 21
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
Affected: before 1.11.1
CVE-2023-37264
4.3
0%
Jul 7
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines
Affected: 0.35.0 and later
Showing 6