KU
Vendor
kubeflow
16
CVEs
0
On KEV
5
New 30D
Products
PI10.0
pipelines
kubeflow
6 CVEs0 on KEV4 new
MR7.1
Model Registry
Kubeflow
1 CVEs0 on KEV1 new
KU7.5
Kubeflow
Kubeflow
3 CVEs0 on KEV0 new
KU7.5
kubeflow/kubeflow
kubeflow
3 CVEs0 on KEV0 new
CO8.0
community-distribution
kubeflow
1 CVEs0 on KEV0 new
KP5.4
Kubeflow Pipeline View
Kubeflow
1 CVEs0 on KEV0 new
KW5.4
Kubeflow W Pipeline View
Kubeflow
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118761 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory |
| CVE-2026-118760 New | PI pipelines kubeflow | 6.5 | Oct 29 | Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads |
| CVE-2026-118759 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant |
| CVE-2026-118758 New | PI pipelines kubeflow | 7.5 | Oct 29 | Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source |
| CVE-2026-110220 | MR Model Registry Kubeflow | 7.1 | Oct 13 | Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation |
| CVE-2026-54745 | PI pipelines kubeflow | 10.0 | Aug 28 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true |
| CVE-2026-47237 | CO community-distribution kubeflow | 8.0 | Jul 21 | Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing |
| CVE-2024-9526 | KP Kubeflow Pipeline View Kubeflow | 5.4 | Nov 18 | Stored XSS in Kubeflow Pipeline View |
| CVE-2024-5552 | KU kubeflow/kubeflow kubeflow | 7.5 | Jun 6 | ReDoS in kubeflow/kubeflow |
| CVE-2023-6571 | KU kubeflow/kubeflow kubeflow | 6.1 | Dec 14 | Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow |
| CVE-2023-6570 | KU kubeflow/kubeflow kubeflow | 6.5 | Dec 14 | Server-Side Request Forgery (SSRF) in kubeflow/kubeflow |