Skip to content
Noroxi

Kubernetes records

102 published records for vendor kubernetes.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
90.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

102 records
  • CVE-2018-1002105
    65This week

    In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    kubernetes · kubernetesDec 5, 2018

  • CVE-2019-11248
    55Plan

    Kubernetes kubelet exposes /debug/pprof info on healthz port

    HighCVSS 8.2Proof of conceptEPSS 75%

    kubernetes · kubernetesAug 28, 2019

  • CVE-2023-5044
    52Plan

    Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

    HighCVSS 8.8Proof of conceptEPSS 56%

    kubernetes · ingress-nginxOct 25, 2023

  • CVE-2018-18264
    51Plan

    Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within

    HighCVSS 7.5Proof of conceptEPSS 70%

    kubernetes · dashboardJan 2, 2019

  • CVE-2024-7646
    43Plan

    A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `ex

    HighCVSS 8.8Proof of conceptEPSS 27%

    kubernetes · ingress-nginxAug 16, 2024

  • CVE-2017-1002101
    42Plan

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with

    CriticalCVSS 9.6Proof of conceptEPSS 12%

    kubernetes · kubernetesMar 13, 2018

  • CVE-2022-0811
    41Plan

    A flaw was found in CRI-O in the way it set kernel options for a pod.

    HighCVSS 8.8Proof of conceptEPSS 19%

    kubernetes · cri-oMar 16, 2022

  • CVE-2016-1906
    40Plan

    Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that

    CriticalCVSS 9.8No exploitEPSS 4%

    kubernetes · kubernetesFeb 3, 2016

  • CVE-2018-1002101
    40Plan

    In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi

    CriticalCVSS 9.8No exploitEPSS 3%

    kubernetes · kubernetesDec 5, 2018

  • CVE-2017-1000056
    40Plan

    Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to

    CriticalCVSS 9.8No exploitEPSS 2%

    kubernetes · kubernetesJul 17, 2017

  • CVE-2025-57870
    40Plan

    BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.

    CriticalCVSS 10.0No exploitEPSS 0%

    esri · arcgis serverOct 22, 2025

  • CVE-2023-3676
    39Monitor

    Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

    HighCVSS 8.8No exploitEPSS 13%

    kubernetes · kubernetesOct 31, 2023

  • CVE-2026-13019
    39Monitor

    Missing Authentication

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisJul 7, 2026

  • CVE-2023-1174
    39Monitor

    [minikube] Network Port exposure in minikube running on macOS using Docker driver

    CriticalCVSS 9.8No exploitEPSS 0%

    kubernetes · minikubeMay 24, 2023

  • CVE-2026-33519
    39Monitor

    Incorrect privilege assignment in Portal for ArcGIS

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisApr 21, 2026

  • CVE-2026-13020
    39Monitor

    Weak Password Recovery Mechanism in Portal for ArcGIS

    CriticalCVSS 9.8No exploitEPSS 0%

    esri · portal for arcgisJul 7, 2026

  • CVE-2019-11253
    38Monitor

    Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

    HighCVSS 7.5Proof of conceptEPSS 25%

    kubernetes · kubernetesOct 17, 2019

  • CVE-2020-8570
    37Monitor

    Kubernetes Java client libraries unvalidated path traversal in Copy implementation

    CriticalCVSS 9.1Proof of conceptEPSS 3%

    kubernetes · javaJan 21, 2021

  • CVE-2023-5528
    36Monitor

    Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

    HighCVSS 8.8No exploitEPSS 4%

    kubernetes · kubernetesNov 14, 2023

  • CVE-2023-3955
    36Monitor

    Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

    HighCVSS 8.8No exploitEPSS 3%

    kubernetes · kubernetesOct 31, 2023

  • CVE-2020-8558
    36Monitor

    Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

    HighCVSS 8.8Proof of conceptEPSS 3%

    kubernetes · kubernetesJul 27, 2020

  • CVE-2023-3893
    36Monitor

    Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation

    HighCVSS 8.8No exploitEPSS 2%

    kubernetes · csi proxyNov 3, 2023

  • CVE-2023-5043
    36Monitor

    Ingress nginx annotation injection causes arbitrary command execution

    HighCVSS 8.8Proof of conceptEPSS 2%

    kubernetes · ingress-nginxOct 25, 2023

  • CVE-2018-1000400
    36Monitor

    Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabi

    HighCVSS 8.8No exploitEPSS 2%

    kubernetes · cri-oMay 18, 2018

  • CVE-2022-3294
    35Monitor

    Node address isn't always verified when proxying

    HighCVSS 8.8Proof of conceptEPSS 1%

    kubernetes · kubernetesMar 1, 2023