TE
Vendor
tektoncd
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54167 | PI pipelines-as-code tektoncd | 8.2 | Sep 15 | Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header |
| CVE-2026-54168 | PI pipelines-as-code tektoncd | 6.5 | Sep 15 | Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution |
| CVE-2026-40923 | PI pipeline tektoncd | 5.4 | Apr 21 | Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check |
| CVE-2026-40924 | PI pipeline tektoncd | 6.5 | Apr 21 | Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion |
| CVE-2026-40938 | PI pipeline tektoncd | 8.5 | Apr 21 | Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE |
| CVE-2026-40161 | PI pipeline tektoncd | 6.5 | Apr 21 | Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL |
| CVE-2026-25542 | PI pipeline tektoncd | 6.5 | Apr 21 | Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching |
| CVE-2026-33211 | PI pipeline tektoncd | 9.6 | Mar 23 | Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod |
| CVE-2026-33022 | PI pipeline tektoncd | 6.5 | Mar 20 | Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun |