Migration Toolkit For Virtualization
24 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Migration Toolkit For Virtualization, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Migration Toolkit For Virtualization CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 1 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 2 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 2 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 3 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 1 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 24 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High14
- Medium6
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Migration Toolkit For Virtualization.
- CVE-2026-11332Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution7.8
- CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted files7.5
- CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage root8.4
- CVE-2026-25645Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function4.4
- CVE-2026-23490pyasn1 has a DoS vulnerability in decoder7.5
- CVE-2025-66471urllib3 Streaming API improperly handles highly compressed data7.5
- CVE-2025-66418urllib3 allows an unbounded number of links in the decompression chain7.5
- CVE-2025-50182urllib3 does not control redirects in browsers and Node.js5.3
- CVE-2025-50181urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation5.3
- CVE-2024-11831Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript5.4
- CVE-2024-45801Tampering by prototype polution in DOMPurify7.3
- CVE-2024-8509Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication7.5
- CVE-2024-24790Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip9.8
- CVE-2023-42282The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.9.8
- CVE-2023-26159Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, ...7.3
Product grouping is registry-driven, with AI assist and human review. How it works