CVE Tools
Track your stack

Openshift Serverless

58 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Openshift Serverless, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Openshift Serverless CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Openshift Serverless CVEs per month
MonthCVEs
2024-121
2025-013
2025-022
2025-031
2025-040
2025-050
2025-061
2025-070
2025-081
2025-093
2025-100
2025-110
2025-124
2026-010
2026-020
2026-032
2026-046
2026-050
2026-060
2026-070
2026-080
2026-091
2026-101
2026-112

Severity

How the 58 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical610%
  • High3052%
  • Medium1831%
  • Low47%

Latest CVEs

The 15 most recently published vulnerabilities affecting Openshift Serverless.

  1. CVE-2026-50240Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount8.8
  2. CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw7.7
  3. CVE-2026-107174Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction6.4
  4. CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security7.5
  5. CVE-2026-33812Excessive memory allocation when decoding malicious SFNT in golang.org/x/image6.1
  6. CVE-2026-32281Inefficient policy validation in crypto/x5097.5
  7. CVE-2026-32280Unexpected work during chain building in crypto/x5097.5
  8. CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tar5.5
  9. CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x5098.2
  10. CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/template6.1
  11. CVE-2026-33748BuildKit Git URL subdir component can cause access to restricted files7.5
  12. CVE-2026-33747BuildKit vulnerable to malicious frontend causing file escape outside of storage root8.4
  13. CVE-2024-29371In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this tok...7.5
  14. CVE-2025-66471urllib3 Streaming API improperly handles highly compressed data7.5
  15. CVE-2025-66418urllib3 allows an unbounded number of links in the decompression chain7.5

Product grouping is registry-driven, with AI assist and human review. How it works