Advisories · Technology
kyverno.
Every CVE that names kyverno among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression
- kyverno
- CWE-409
- CVSS 8.7 High
Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression
- kyverno
- CWE-409
- CVSS 8.5 High
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
- kyverno
- Race condition
- CVSS 8.3 High
Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone
- kyverno
- Broken access control
- CVSS 8.7 High
Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic
- kyverno
- CWE-704
- CVSS 7.2 High
Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates
- kyverno
- Weak cryptography or TLS
- CVSS 8.4 High
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting
- kyverno
- Broken access control
- CVSS 8.7 High
Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic
- kyverno
- CWE-248
- CVSS 8.7 High
Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic
- kyverno
- CWE-248
- CVSS 9.4 CriticalCritical · CVSS 9+
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy
- kyverno
- Privilege escalation
- CVSS 8.3 High
Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query String
- kyverno
- Privilege escalation
- CVSS 9.4 CriticalCritical · CVSS 9+
Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument
- kyverno
- Path traversal
- CVSS 9.4 CriticalCritical · CVSS 9+
Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath
- kyverno
- CWE-436
- CVSS 8.2 High
Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost
- kyverno
- Denial of service
- CVSS 8.4 High
Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest
- kyverno
- Broken access control
- CVSS 8.3 High
Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling
- kyverno
- Broken access control
- CVSS 8.3 High
Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching
- kyverno
- Denial of service
- CVSS 8.3 High
Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop
- kyverno
- Denial of service
- CVSS 9.4 CriticalCritical · CVSS 9+
Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader
- kyverno
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy
- kyverno
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
- kyverno
- Privilege escalation
- CVSS 8.3 High
Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path
- kyverno
- Path traversal
- CVSS 9.4 CriticalCritical · CVSS 9+
kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
- kyverno
- CWE-441
- CVSS 8.3 High
Kyverno before 1.19.1 SSRF via legacy apiCall service executor
- kyverno
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass
- kyverno
- Broken access control
- CVSS 8.3 High
Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib
- kyverno
- Information disclosure