https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:35:14 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0685 certfr-2026-avi-0685 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0685 https://cve.radiocsirt.org/vuln/euvd-2026-366104 EUVD-2026-366104 https://cve.radiocsirt.org/vuln/euvd-2026-366104 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7374 <p>A flaw was found in KubeVirt&#39;s virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host&#39;s container runtime (CRI-O) socket, an attacker can hijack virt-handler&#39;s privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.</p> <p>A flaw was found in KubeVirt&#39;s virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host&#39;s container runtime (CRI-O) socket, an attacker can hijack virt-handler&#39;s privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-7374 https://cve.radiocsirt.org/vuln/ghsa-7jcp-v9w4-wjmg <p><strong>Affected:</strong> Go: kubevirt.io/kubevirt</p> <p>A flaw was found in KubeVirt&#39;s virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host&#39;s container runtime (CRI-O) socket, an attacker can hijack virt-handler&#39;s privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.</p> <p><strong>Affected:</strong> Go: kubevirt.io/kubevirt</p> <p>A flaw was found in KubeVirt&#39;s virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket with a symlink to the host&#39;s container runtime (CRI-O) socket, an attacker can hijack virt-handler&#39;s privileged connection. This enables the attacker to access any Unix socket on the host, potentially leading to full control of the node and the entire cluster.</p> https://cve.radiocsirt.org/vuln/ghsa-7jcp-v9w4-wjmg https://cve.radiocsirt.org/vuln/msrc_cve-2026-7374 msrc_CVE-2026-7374 https://cve.radiocsirt.org/vuln/msrc_cve-2026-7374 https://cve.radiocsirt.org/vuln/rhsa-2026:20720 <p>kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability</p> <p>kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability</p> https://cve.radiocsirt.org/vuln/rhsa-2026:20720 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1680 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Virtualization ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Virtualization ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1680