https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T21:44:36.529689+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-210102 EUVD-2026-210102 2026-10-23T21:44:36.673320+00:00 EUVD-2026-210102 https://cve.radiocsirt.org/vuln/fkie_cve-2023-33191 fkie_cve-2023-33191 2026-10-23T21:44:36.673359+00:00

Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.

 https://cve.radiocsirt.org/vuln/ghsa-33hq-f2mf-jm3c GHSA-33hq-f2mf-jm3c — kyverno seccomp control can be circumvented 2026-10-23T21:44:36.673406+00:00

Affected: Go: github.com/kyverno/kyverno

### Impact

Users of the podSecurity (`validate.podSecurity`) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a `version` value of `latest`. There is no effect if a version number is referenced instead. See the [documentation](https://kyverno.io/docs/writing-policies/validate/#pod-security) for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.

### Patches

v1.9.4 v1.10.0

### Workarounds

To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline [here](https://kyverno.io/policies/pod-security/baseline/restrict-seccomp/restrict-seccomp/) and restricted [here](https://kyverno.io/policies/pod-security/restricted/restrict-seccomp-strict/restrict-seccomp-strict/).

### References

* https://kyverno.io/docs/writing-policies/validate/#pod-security * https://github.com/kyverno/kyverno/pull/7263

 https://cve.radiocsirt.org/vuln/gsd-2023-33191 gsd-2023-33191 2026-10-23T21:44:36.673443+00:00 gsd-2023-33191