Kubernetes vulnerabilities

CVEs per yearBy the year they were published

1. 20186
2. 20183
3. 201915
4. 202118
5. 202313
6. 20235
7. 202312
8. 20249
9. 202514
10. 202611

Newest CVEs

• CVE-2026-2270

  StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

  Kubernetes · Kubernetes

  Medium5.9
• CVE-2026-76654

  Subpath symlinking on Windows nodes permits NTLM coercion

  Kubernetes · Kubernetes

  Medium5.8
• CVE-2026-19444

  Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

  Kubernetes · Kubernetes

  Medium6.5
• CVE-2026-15687

  Path traversal via non-tar copyDirectoryFromPod

  Kubernetes · kubernetes-client/java

  Low2.7
• CVE-2026-3864

  CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server

  Kubernetes · CSI Driver for NFS

  Medium6.5
• CVE-2026-4342

  ingress-nginx comment-based nginx configuration injection

  Kubernetes · ingress-nginx

  High8.8
• CVE-2026-3288

  ingress-nginx rewrite-target nginx configuration injection

  Kubernetes · ingress-nginx

  High8.8
• CVE-2025-15566

  ingress-nginx auth-proxy-set-headers nginx configuration injection

  Kubernetes · ingress-nginx

  High8.8
• CVE-2026-24514

  ingress-nginx Admission Controller denial of service

  Kubernetes · ingress-nginx

  Medium6.5
• CVE-2026-24513

  ingress-nginx auth-url protection bypass

  Kubernetes · ingress-nginx

  Low3.1