Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownSubpath symlinking on Windows nodes permits NTLM coercionSep 14, 2026
- UnknownStatefulSet and ControllerRevision write permissions allow cross-namespace pod creationSep 14, 2026
- Unknownkubectl cp path traversal on Windows allows arbitrary file writesEPSS 0.2%Aug 10, 2026
- UnknownCSI Driver for SMB path traversal via subDir may delete unintended directories on the SMB serverApr 10, 2026
- High8.8A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx.Mar 19, 2026
- Medium6.5A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated.Mar 17, 2026
- High8.8A security issue was discovered in ingress-nginx where the Ingress annotation can be used to inject configuration into nginx.Mar 9, 2026
- Unknowningress-nginx auth-proxy-set-headers nginx configuration injectionEPSS 0.5%Feb 6, 2026
- Unknowningress-nginx Admission Controller denial of serviceFeb 2, 2026
- Unknowningress-nginx auth-url protection bypassFeb 2, 2026
- Unknowningress-nginx rules.http.paths.path nginx configuration injectionFeb 2, 2026
- Unknowningress-nginx auth-method nginx configuration injectionEPSS 0.5%Feb 2, 2026
- UnknownCredential caching in Headlamp with Helm enabledDec 17, 2025
- Medium5.8A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass.EPSS 0.4%Nov 30, 2025
- UnknownKubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacksEPSS 0.3%Sep 15, 2025
- Unknownsecrets-store-sync-controller discloses service account tokens in logsEPSS 0.2%Sep 4, 2025
- UnknownNodes can delete themselves by adding an OwnerReferenceEPSS 0.6%Aug 11, 2025
- UnknownVM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not overrideEPSS 0.4%Jul 21, 2025
- UnknownNodes can bypass dynamic resource allocation authorization checksEPSS 0.8%Jun 6, 2025
- Unknowningress-nginx admission controller RCE escalationEPSS 99.4%Mar 23, 2025
- Unknowningress-nginx controller configuration injection via unsanitized mirror annotationsEPSS 82.3%Mar 23, 2025
- Unknowningress-nginx controller configuration injection via unsanitized auth-tls-match-cn annotationEPSS 33.2%Mar 23, 2025
- Unknowningress-nginx controller configuration injection via unsanitized auth-url annotationEPSS 30.5%Mar 23, 2025
- Unknowningress-nginx controller auth secret file path traversal vulnerabilityEPSS 3.3%Mar 23, 2025
- UnknownGitRepo Volume Inadvertent Local Repository AccessEPSS 0.7%Mar 13, 2025
25 records · page 1 of 1
PreviousNext