Redhat Openshift Virtualization vulnerabilities

• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled CVE-2026-13434 4.9 MediumJune 26, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service CVE-2026-13322 3.8 LowJune 26, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip CVE-2026-13318 Fix available 6.4 MediumJune 25, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher CVE-2026-13218 4.2 MediumJune 25, 2026
• kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 more Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body CVE-2026-13208 6.5 MediumJune 24, 2026
• kubevirt, red hat container native virtualization 4.12, container native virtualization 4.13 +10 more +12 more Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption CVE-2026-13201 Fix available 7.3 HighJune 24, 2026
• axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495 Fix available 7.0 HighMay 29, 2026
• immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 more Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVE-2026-29063 Fix available 8.7 HighMarch 4, 2026
• 9bis kitty, apache sshd, sshj +68 more +70 more Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795 Public exploitFix available EPSS 93.5% 5.9 MediumDecember 18, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• nmstate kubernetes-nmstate, redhat openshift virtualization +1 more Withdrawn Advisory: kubernetes-nmstate Insecure Privilege Management CVE-2020-1742 7.0 HighJune 7, 2021
• kubevirt, redhat openshift virtualization +1 more Privilege Escalation in kubevirt CVE-2020-14316 Fix available 9.9 CriticalJuly 29, 2020