Known vulnerabilities in Ingress-NGINX Controller for Kubernetes

Vendor: Kubernetes
Software CPE: cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*
Total vulnerabilities: 15
Public exploits: 5
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ingress-NGINX Controller for Kubernetes Ingress-NGINX Controller for Kubernetes is affected by 15 known vulnerabilities: 1 critical, 4 high, 9 medium, 1 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123877 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-3288
CWE-94 High
No
No
1.13.8, 1.14.4 11.03.2026 SB2026031120
SB2026042288
#VU122289 - Improper input validation
CVE-2026-24514
CWE-20 Medium
No
No
1.13.7, 1.14.3 04.02.2026 SB2026020407
#VU122288 - Improper Authorization
CVE-2026-24513
CWE-285 Low
No
No
1.13.7, 1.14.3 04.02.2026 SB2026020407
#VU122287 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-24512
CWE-94 Medium
No
No
1.13.7, 1.14.3 04.02.2026 SB2026020407
#VU122286 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-1580
CWE-94 Medium
No
No
1.13.7, 1.14.3 04.02.2026 SB2026020407
#VU105990 - Permissions, Privileges, and Access Controls
CVE-2025-1097
CWE-264 Medium
No
No
1.11.5, 1.12.1 24.03.2025 SB2025032478
SB2025060659
SB20250620101
#VU105989 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-24513
CWE-22 Medium
No
No
1.11.5, 1.12.1 24.03.2025 SB2025032478
SB2025060659
SB20250620101
#VU105988 - Permissions, Privileges, and Access Controls
CVE-2025-24514
CWE-264 Medium
Available
No
1.11.5, 1.12.1 24.03.2025 SB2025032478
SB2025060659
SB20250620101
and 1 more
#VU105987 - Improper input validation
CVE-2025-1974
CWE-20 Critical
Available
No
1.11.5, 1.12.1 24.03.2025 SB2025032478
SB20250416107
SB2025060659
and 2 more
#VU105986 - Permissions, Privileges, and Access Controls
CVE-2025-1098
CWE-264 Medium
No
No
1.11.5, 1.12.1 24.03.2025 SB2025032478
SB2025060659
SB20250620101
#VU102099 - Improper input validation
CVE-2024-7646
CWE-20 High
No
No
1.11.2 30.12.2024 SB20241230123
SB20241230139
SB2025032042
and 1 more
#VU82559 - Improper input validation
CVE-2022-4886
CWE-20 High
No
No
1.8.0 30.10.2023 SB2023103025
SB2024032043
#VU82557 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-5044
CWE-94 Medium
Available
No
1.9.0 30.10.2023 SB2023103025
SB2024032043
#VU82556 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-5043
CWE-78 Medium
Available
No
1.9.0 30.10.2023 SB2023103025
SB2024032043
#VU81728 - Resource exhaustion
CVE-2023-44487
CWE-400 High
Available
Exploited
1.9.5 10.10.2023 SB2023101023
SB2023101024
SB2023101037
and 650 more