OC
Product
Openshift Container Platform
On CISA KEVExploited in the wild
338
CVEs
7
On KEV
10.0
Max CVSS
10
New 30D
Severity mix
Critical 39High 141Medium 148Low 10
Watch
Add Openshift Container Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-7609 In wildKEV | 10.0 | Mar 25 | Kibana Arbitrary Code Execution Affected: 3.11; 4.1 |
| CVE-2019-1003029 In wildKEV | 9.9 | Mar 8 | Jenkins Script Security Plugin Sandbox Bypass Vulnerability Affected: 3.11 |
| CVE-2019-1003030 In wildKEV | 9.9 | Mar 8 | Jenkins Matrix Project Plugin Remote Code Execution Vulnerability Affected: 3.11 |
| CVE-2018-1000861 In wildKEV | 9.8 | Dec 10 | A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in… Affected: 3.11 |
| CVE-2018-14721 | 10.0 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 3.11 |
| CVE-2019-1003031 | 9.9 | Mar 8 | A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with… Affected: 3.11 |
| CVE-2019-1003034 | 9.9 | Mar 8 | A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy,… Affected: 3.11 |
| CVE-2026-4408 | 9.8 | May 28 | Samba: remote code execution in samr Affected: 4.0 |
| CVE-2026-42010 | 9.8 | May 7 | Gnutls: gnutls: authentication bypass via nul character in username Affected: 4.0 |
| CVE-2022-4039 | 9.8 | Sep 22 | A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled Affected: 4.9; 4.10 |
| CVE-2020-27836 | 9.8 | Aug 22 | A flaw was found in cluster-ingress-operator Affected: 4.6 |
| CVE-2020-27846 | 9.8 | Dec 21 | A signature verification vulnerability exists in crewjam/saml Affected: 3.11; 4.0 |
| CVE-2019-14892 | 9.8 | Mar 2 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 4.3 |
| CVE-2019-14813 | 9.8 | Sep 6 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass… Affected: 3.11; 4.1 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 4.1; 3.11 |
| CVE-2019-1010238 | 9.8 | Jul 19 | Gnome Pango 1.42 and later is affected by: Buffer Overflow Affected: 3.11; 4.1 |
| CVE-2018-11307 | 9.8 | Jul 9 | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5 Affected: 3.11; 4.1 |
| CVE-2019-3899 | 9.8 | Apr 22 | It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse Affected: 3.11 |
| CVE-2019-1003041 | 9.8 | Mar 28 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts Affected: 3.11 |
| CVE-2019-1003040 | 9.8 | Mar 28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts Affected: 3.11 |
| CVE-2019-9636 | 9.8 | Mar 8 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization Affected: 3.11 |
| CVE-2018-19361 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization Affected: 3.11 |
| CVE-2018-19360 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic… Affected: 3.11 |
| CVE-2018-14720 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 3.11 |
| CVE-2018-14719 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from… Affected: 3.11 before 3.11.153; 4.6 before 4.6.26; 4.1 before 4.1.18 |
| CVE-2018-14718 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 3.11 before 3.11.153; 4.6 before 4.6.26; 3.10; 4.1 before 4.1.18 |
| CVE-2018-19362 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic… Affected: 3.11 |
| CVE-2018-17246 | 9.8 | Dec 20 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin Affected: 3.11 |
| CVE-2018-18311 | 9.8 | Dec 7 | Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations Affected: 3.11 |
| CVE-2018-1002105 | 9.8 | Dec 5 | In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially… Affected: 3.2; 3.3; 3.4; 3.5; 3.6; 3.8; +2 more |
| CVE-2017-7481 | 9.8 | Jul 19 | Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe Affected: 3.3; 3.4; 3.5 |
| CVE-2018-12910 | 9.8 | Jul 5 | The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname Affected: 3.11 |
| CVE-2018-1085 | 9.8 | Jun 15 | openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled Affected: before 3.9.31 |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 3.11; 4.1 |
| CVE-2017-7525 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 4.1; 3.11 |
| CVE-2017-17485 | 9.8 | Jan 10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Affected: 4.1; 3.11 |
| CVE-2015-8103 | 9.8 | Nov 25 | The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a… Affected: 2.2; 3.1 |
| CVE-2026-33845 | 9.1 | Apr 30 | Gnutls: gnutls: denial of service via dtls zero-length fragment Affected: 4.0 |
| CVE-2026-4480 | 9.0 | May 26 | Samba: samba: remote code execution in printing subsystem via unescaped job description Affected: 4.0 |
Showing 39