Kubevirt.io/kubevirt
15 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Kubevirt.io/kubevirt, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Kubevirt.io/kubevirt CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 7 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High3
- Medium10
Latest CVEs
The 15 most recently published vulnerabilities affecting Kubevirt.io/kubevirt.
- CVE-2025-14525Kubevirt: kubevirt: vm administration denial of service via guest agent6.4
- CVE-2025-64324KubeVirt Vulnerable to Arbitrary Host File Read and Write7.7
- CVE-2025-64433KubeVirt Arbitrary Container File Read6.5
- CVE-2025-64437KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes5.0
- CVE-2025-64436KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes5.3
- CVE-2025-64435KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation5.3
- CVE-2025-64434KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing4.7
- CVE-2025-64432KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer4.7
- CVE-2024-33394An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.5.9
- CVE-2024-31420Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes6.5
- CVE-2023-26484On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs8.2
- CVE-2022-1798Path Traversal vulnerability in Kubevirt8.7
- GHSA-qv98-3369-g364KubeVirt vulnerable to arbitrary file read on host—
- CVE-2020-1701A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within thei...6.5
- CVE-2020-14316A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privile...9.9
Product grouping is registry-driven, with AI assist and human review. How it works