GHSA-9M94-W2VQ-HCF9 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

Summary Short summary of the problem. Make the impact and severity as clear as possible. A logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

Summary Short summary of the problem. Make the impact and severity as clear as possible. A logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

KubeVirt Arbitrary Container File Read

Summary Short summary of the problem. Make the impact and severity as clear as possible. Mounting a user-controlled PVC disk within a VM allows an attacker to read any file present in the virt-launcher pod. This is due to erroneous handling of symlinks defined within a PVC. Details Give all detai...

PT-2025-45511

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.3 KubeVirt versions prior to 1.6.1 Description KubeVirt, a virtual machine management add-on for Kubernetes, contains a flaw that permits a virtual machine VM to read arbitrary files from the virt-launcher pod's...

Improper Authentication Exposure

github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: yunikorn-web, ghaudit, kubescape-operator, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, spark-operator, kubernetes-csi-driver-hostpath, harbor-registry, nerdctl, cortex, x509-certificate-exporter, azure-ipam, logstash-exporter, direnv,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, yunikorn-web, ghaudit, kubescape-operator, aws-sigv4-proxy, kind, go-licenses, crossplane, timoni, rancher-loglevel, neuvector-sigstore-interface, kubernetes-event-exporter, kube-rbac-proxy, secrets-store-csi-driver-provider-aws, guac, wave,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: jitsucom-bulker, doppler-kubernetes-operator, mc-fips, xcaddy, cilium-fips, cargobump, kapp, k3d, chisel, crossplane, kubeflow, external-dns-fips, prometheus-alertmanager, grpc-health-probe-fips, terraform-provider-time, x509-certificate-exporter-fips, kapp-fips,...