CVE Tools
Track your stack

Openshift Pipelines

32 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Openshift Pipelines, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Openshift Pipelines CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Openshift Pipelines CVEs per month
MonthCVEs
2024-120
2025-011
2025-021
2025-030
2025-040
2025-050
2025-061
2025-070
2025-081
2025-090
2025-101
2025-110
2025-123
2026-012
2026-021
2026-031
2026-045
2026-050
2026-061
2026-070
2026-080
2026-090
2026-100
2026-111

Severity

How the 32 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical39%
  • High1650%
  • Medium1134%
  • Low26%

Latest CVEs

The 15 most recently published vulnerabilities affecting Openshift Pipelines.

  1. CVE-2026-50240Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount8.8
  2. CVE-2026-10840Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources7.1
  3. CVE-2026-32281Inefficient policy validation in crypto/x5097.5
  4. CVE-2026-32280Unexpected work during chain building in crypto/x5097.5
  5. CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tar5.5
  6. CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x5098.2
  7. CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/template6.1
  8. CVE-2026-29063Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable9.8
  9. CVE-2026-27903minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments7.5
  10. CVE-2025-11065Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure5.3
  11. CVE-2025-69413In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.5.3
  12. CVE-2025-68938Gitea before 1.25.2 mishandles authorization for deletion of releases.4.3
  13. CVE-2025-66471urllib3 Streaming API improperly handles highly compressed data7.5
  14. CVE-2025-66418urllib3 allows an unbounded number of links in the decompression chain7.5
  15. CVE-2025-11621Vault AWS auth method bypass due to AWS client cache8.1

Product grouping is registry-driven, with AI assist and human review. How it works