Kyverno Kyverno

• CVE-2026-122323 High 7.5 Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression 0.3%
• CVE-2026-122322 High 7.5 Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression 0.4%
• CVE-2026-122321 Critical 9.1 Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass 0.2%
• CVE-2026-122320 High 7.7 Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone 0.2%
• CVE-2026-122319 High 7.5 Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic 0.3%
• CVE-2026-122318 High 7.7 Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates 0.2%
• CVE-2026-122316 High 8.5 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting 0.2%
• CVE-2026-122315 High 7.5 Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic 0.4%
• CVE-2026-122314 High 7.5 Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic 0.3%
• CVE-2026-122313 Critical 9.9 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy 0.3%
• CVE-2026-122312 High 7.7 Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String 0.3%
• CVE-2026-122311 Critical 9.9 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument 0.4%
• CVE-2026-122310 Critical 9.9 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath 0.4%
• CVE-2026-122309 Medium 6.2 Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost 0.2%
• CVE-2026-122308 High 8.5 Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest 0.2%
• CVE-2026-122307 High 7.7 Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling 0.2%
• CVE-2026-122306 High 7.7 Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching 0.3%
• CVE-2026-122305 High 7.7 Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop 0.3%
• CVE-2026-122304 Critical 9.9 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader 0.4%
• CVE-2026-122303 Critical 9.9 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy 0.3%
• CVE-2026-122302 Critical 9.8 Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check 0.3%
• CVE-2026-100707 High 7.7 Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path 0.5%
• CVE-2026-100706 Critical 9.9 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath 0.6%
• CVE-2026-100705 High 7.6 Kyverno before 1.19.1 SSRF via legacy apiCall service executor 0.2%
• CVE-2026-100704 High 7.7 Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass 0.2%
• CVE-2026-100703 High 7.7 Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib 0.2%
• CVE-2026-84200 Critical 9.0 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions 0.3%
• CVE-2026-84199 High 7.7 Kyverno before 1.16.2 SSRF via APICall Feature 0.4%
• CVE-2026-84196 High 7.7 Kyverno before 1.18.0 Server-Side Request Forgery via apiCall 0.4%
• CVE-2026-84195 High 7.7 Kyverno before 1.16.4 Credential Leak via apiCall 0.4%
• CVE-2025-15613 Medium 6.5 Kyverno before v1.13.4 SSRF via Service Call 0.4%
• CVE-2023-54356 Low 3.7 Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites 0.2%
• CVE-2026-54523 Critical 9.6 Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system 0.5%
• CVE-2026-44245 Medium 6.1 Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component 0.2%
• CVE-2026-41485 High 7.7 Kyverno Controller Denial of Service via forEach Mutation Panic 0.4%
• CVE-2026-41323 High 8.1 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL 0.6%
• CVE-2026-41068 High 7.7 Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) 0.3%
• CVE-2026-40868 High 8.1 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token 0.3%
• CVE-2026-4789 Critical 9.8 CVE-2026-4789 0.7%
• CVE-2026-23881 High 7.7 Kyverno Denial of Service via Context Variable Amplification in Policy Engine 0.6%
• CVE-2026-22039 Critical 10.0 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall 0.6%
• CVE-2025-47281 High 7.7 Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service 0.6%
• CVE-2025-46342 High 8.6 Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements 0.8%
• CVE-2025-29778 Medium 5.8 Kyverno ignores subjectRegExp and IssuerRegExp 0.3%
• CVE-2024-48921 High 8.7 Kyverno's PolicyException objects can be created in any namespace by default 0.6%
• CVE-2023-47630 High 7.1 Attacker can cause Kyverno user to unintentionally consume insecure image 0.3%
• CVE-2023-42813 Medium 6.1 Denial of service from malicious manifest in kyverno 0.7%
• CVE-2023-42814 Low 3.1 Denial of service from malicious image manifest in kyverno 0.7%
• CVE-2023-42815 Low 3.1 Denial of service from malicious image manifest in kyverno 0.7%
• CVE-2023-42816 Medium 6.1 Denial of service from malicious signature in kyverno 0.5%