# kyverno.

Every CVE that names kyverno among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression](https://agentprime.io/advisories/CVE-2026-122323.md)
  `CVE-2026-122323` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-409
- [Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression](https://agentprime.io/advisories/CVE-2026-122322.md)
  `CVE-2026-122322` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-409
- [Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass](https://agentprime.io/advisories/CVE-2026-122321.md)
  `CVE-2026-122321` · CVE record: kyverno kyverno · CVSS 8.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Race condition
- [Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone](https://agentprime.io/advisories/CVE-2026-122320.md)
  `CVE-2026-122320` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic](https://agentprime.io/advisories/CVE-2026-122319.md)
  `CVE-2026-122319` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-704
- [Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates](https://agentprime.io/advisories/CVE-2026-122318.md)
  `CVE-2026-122318` · CVE record: kyverno kyverno · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting](https://agentprime.io/advisories/CVE-2026-122316.md)
  `CVE-2026-122316` · CVE record: kyverno kyverno · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic](https://agentprime.io/advisories/CVE-2026-122315.md)
  `CVE-2026-122315` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-248
- [Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic](https://agentprime.io/advisories/CVE-2026-122314.md)
  `CVE-2026-122314` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-248
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy](https://agentprime.io/advisories/CVE-2026-122313.md)
  `CVE-2026-122313` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String](https://agentprime.io/advisories/CVE-2026-122312.md)
  `CVE-2026-122312` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument](https://agentprime.io/advisories/CVE-2026-122311.md)
  `CVE-2026-122311` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal
- [Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath](https://agentprime.io/advisories/CVE-2026-122310.md)
  `CVE-2026-122310` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-436
- [Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost](https://agentprime.io/advisories/CVE-2026-122309.md)
  `CVE-2026-122309` · CVE record: kyverno kyverno · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest](https://agentprime.io/advisories/CVE-2026-122308.md)
  `CVE-2026-122308` · CVE record: kyverno kyverno · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling](https://agentprime.io/advisories/CVE-2026-122307.md)
  `CVE-2026-122307` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching](https://agentprime.io/advisories/CVE-2026-122306.md)
  `CVE-2026-122306` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop](https://agentprime.io/advisories/CVE-2026-122305.md)
  `CVE-2026-122305` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service
- [Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader](https://agentprime.io/advisories/CVE-2026-122304.md)
  `CVE-2026-122304` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy](https://agentprime.io/advisories/CVE-2026-122303.md)
  `CVE-2026-122303` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check](https://agentprime.io/advisories/CVE-2026-122302.md)
  `CVE-2026-122302` · CVE record: kyverno kyverno · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path](https://agentprime.io/advisories/CVE-2026-100707.md)
  `CVE-2026-100707` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath](https://agentprime.io/advisories/CVE-2026-100706.md)
  `CVE-2026-100706` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-441
- [Kyverno before 1.19.1 SSRF via legacy apiCall service executor](https://agentprime.io/advisories/CVE-2026-100705.md)
  `CVE-2026-100705` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass](https://agentprime.io/advisories/CVE-2026-100704.md)
  `CVE-2026-100704` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib](https://agentprime.io/advisories/CVE-2026-100703.md)
  `CVE-2026-100703` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=kyverno>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/kyverno/>. Everything for agents: <https://agentprime.io/llms.txt>.