Red Hat Openshift Virtualization 4 vulnerabilities

25 CVEs affecting Red Hat Openshift Virtualization 4, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92982, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2024-3727, published 2024-05-14. High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion,…
CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
CVE-2026-9804, published 2026-05-28. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2024-31420, published 2024-04-03. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-17527, published 2026-07-27. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source…
CVE-2024-52011, published 2026-06-01. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an…

Latest

CVE-2026-92982, published 2026-10-15. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values.…
CVE-2026-102623, published 2026-09-29. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an…
CVE-2026-79705, published 2026-09-15. Medium severity, CVSS 4.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory…
CVE-2026-79699, published 2026-09-15. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with…
CVE-2026-19730, published 2026-08-13. Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days. The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable…