How many CVEs does Kubernetes have?

Kubernetes has 140 published CVE records since 2015, including 34 in the last two years.

How many Kubernetes CVEs are in CISA KEV?

1 of Kubernetes's CVEs is listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Kubernetes products have the most CVEs?

The Kubernetes products with the most published CVEs are Kubernetes, ingress-nginx, cri-o, github.com/kubernetes/kubernetes, Kubelet.

What are the most common weakness types in Kubernetes CVEs?

Kubernetes's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-532 (Insertion of Sensitive Information into Log File), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption).

How many critical Kubernetes vulnerabilities are there?

Kubernetes has 14 critical and 52 high-severity CVEs.

What is the average severity of Kubernetes CVEs?

The average CVSS base score across Kubernetes's scored CVEs is 7.0.

Kubernetes Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Kubernetes vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Kubernetes has 140 published CVE records since 2015, of which 1 is in CISA's Known Exploited Vulnerabilities catalog and 28 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

Security scorecard

A quick read on Kubernetes's vulnerability posture, as a share of its 140 published CVEs.

Average CVSS: 7.0
Critical / high: 47%
Actively exploited (KEV): 1%
Public exploit available: 20%
Patch available: 98%

Severity and exploitation

How the CVSS severity of Kubernetes's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical14

High52

Medium62

Low12

In CISA’s Known Exploited Vulnerabilities catalog

One of Kubernetes's CVEs is confirmed exploited in the wild.

Public exploits

28 of Kubernetes's CVEs have a known public exploit available.

Most affected products

The Kubernetes products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Kubernetes CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Kubernetes CVE records.

Disclosure activity by year

How many Kubernetes CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest Kubernetes CVEs

The most recently disclosed vulnerabilities affecting Kubernetes.

ingress-nginx mirror-target self-DOS
CWE-20
Low · CVSS 2.7
EPSS 0.4%2026-11-05
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
CWE-639
Medium · CVSS 5.9
EPSS 0.3%2026-10-26
Subpath symlinking on Windows nodes permits NTLM coercion
CWE-59
Medium · CVSS 5.8
EPSS 0.4%2026-10-26
Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

Other vendors

CVE counts for other vendors.

NEC141 CVEs Tungsten Automation141 CVEs ruby-lang140 CVEs AncoraThemes140 CVEs anisha140 CVEs Avaya140 CVEs Asterisk139 CVEs NLnet Labs139 CVEs

Browse all vendors

Frequently asked questions

Common questions about Kubernetes vulnerabilities.

How many CVEs does Kubernetes have?: Kubernetes has 140 published CVE records since 2015, including 34 in the last two years.
How many Kubernetes CVEs are in CISA KEV?: 1 of Kubernetes's CVEs is listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Kubernetes products have the most CVEs?: The Kubernetes products with the most published CVEs are Kubernetes, ingress-nginx, cri-o, github.com/kubernetes/kubernetes, Kubelet.
What are the most common weakness types in Kubernetes CVEs?: Kubernetes's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-532 (Insertion of Sensitive Information into Log File), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption).
Are there public exploits for Kubernetes vulnerabilities?: Yes — 28 of Kubernetes's CVEs have a known public exploit.
How many critical Kubernetes vulnerabilities are there?: Kubernetes has 14 critical and 52 high-severity CVEs.
What is the average severity of Kubernetes CVEs?: The average CVSS base score across Kubernetes's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Kubernetes vulnerabilities

Get an alert for each new Kubernetes CVE, with AI-written analysis and remediation steps.

Create an account See pricing

Get an alert for each new Kubernetes CVE, with AI-written analysis and remediation steps.

Monitor these CVEs