[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-13201":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":24,"aliases":25,"duplicate_of":9,"upstream":26,"downstream":27,"duplicates":38,"related":39,"reserved_at":9,"published_at":45,"modified_at":46,"state":47,"summary":48,"references_raw":57,"kevs":112,"epss":113,"epss_history":116,"metrics":357,"affected":365},"CVE-2026-13201","A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-61","UNIX Symbolic Link (Symlink) Following","The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.","weakness","Incomplete","Compound","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-27","Leveraging Race Conditions via Symbolic Links",[],[],[],[],[28,30,32,34,36],{"_key":29},"SUSE-SU-2026:3480-1",{"_key":31},"OPENSUSE-SU-2026:11392-1",{"_key":33},"OPENSUSE-SU-2026:11520-1",{"_key":35},"SUSE-SU-2026:3630-1",{"_key":37},"OPENSUSE-SU-2026:21590-1",[],[40,41,42,43,44],{"_key":29},{"_key":31},{"_key":33},{"_key":35},{"_key":37},"2026-06-24T20:39:00.173Z","2026-09-08T18:46:24.770Z","Modified",{"cisa_kev":49,"cisa_ransomware":49,"cisa_vendor":9,"epss_severity":50,"epss_score":51,"severity":52,"severity_score":53,"severity_version":54,"severity_source":55,"severity_vector":56,"severity_status":47},false,"low",0.00222,"high",7.3,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",[58,67,72,76,80,84,88,92,96,100,104,108],{"url":59,"sources":60,"tags":62},"https://access.redhat.com/security/cve/CVE-2026-13201",[55,61],"nvd",[63,64,65,66],"VDB Entry","X Refsource REDHAT","Mitigation","Vendor Advisory",{"url":68,"sources":69,"tags":70},"https://bugzilla.redhat.com/show_bug.cgi?id=2492203",[55,61],[71,64,66],"Issue Tracking",{"url":73,"sources":74,"tags":75},"https://access.redhat.com/errata/RHSA-2026:51031",[55,61],[66,64],{"url":77,"sources":78,"tags":79},"https://access.redhat.com/errata/RHSA-2026:53655",[55,61],[66,64],{"url":81,"sources":82,"tags":83},"https://access.redhat.com/errata/RHSA-2026:53671",[55,61],[66,64],{"url":85,"sources":86,"tags":87},"https://access.redhat.com/errata/RHSA-2026:53684",[55,61],[66,64],{"url":89,"sources":90,"tags":91},"https://access.redhat.com/errata/RHSA-2026:53721",[55,61],[66,64],{"url":93,"sources":94,"tags":95},"https://access.redhat.com/errata/RHSA-2026:53728",[55,61],[66,64],{"url":97,"sources":98,"tags":99},"https://access.redhat.com/errata/RHSA-2026:53763",[55,61],[66,64],{"url":101,"sources":102,"tags":103},"https://access.redhat.com/errata/RHSA-2026:53797",[55,61],[66,64],{"url":105,"sources":106,"tags":107},"https://access.redhat.com/errata/RHSA-2026:53826",[55,61],[66,64],{"url":109,"sources":110,"tags":111},"https://access.redhat.com/errata/RHSA-2026:53838",[55,61],[66,64],[],{"date":114,"score":51,"percentile":115},"2026-09-19",0.13083,[117,121,125,128,131,134,137,139,141,143,145,147,149,152,155,158,161,163,165,168,170,173,176,178,180,183,186,189,192,195,198,201,203,205,207,210,212,214,216,219,222,224,227,229,233,236,239,242,244,248,251,254,257,260,262,265,268,271,274,277,280,283,286,289,292,295,298,301,304,307,310,312,315,318,321,324,326,329,332,335,338,341,344,347,350,353,356],{"date":118,"score":119,"percentile":120},"2026-06-25",0.00122,0.02275,{"date":122,"score":123,"percentile":124},"2026-06-26",0.00124,0.02491,{"date":126,"score":123,"percentile":127},"2026-06-27",0.02499,{"date":129,"score":123,"percentile":130},"2026-06-28",0.02502,{"date":132,"score":123,"percentile":133},"2026-06-29",0.02497,{"date":135,"score":123,"percentile":136},"2026-06-30",0.02498,{"date":138,"score":123,"percentile":136},"2026-07-01",{"date":140,"score":123,"percentile":133},"2026-07-02",{"date":142,"score":123,"percentile":133},"2026-07-03",{"date":144,"score":123,"percentile":136},"2026-07-04",{"date":146,"score":123,"percentile":136},"2026-07-05",{"date":148,"score":123,"percentile":127},"2026-07-06",{"date":150,"score":119,"percentile":151},"2026-07-07",0.02345,{"date":153,"score":119,"percentile":154},"2026-07-08",0.02355,{"date":156,"score":119,"percentile":157},"2026-07-09",0.02367,{"date":159,"score":119,"percentile":160},"2026-07-10",0.02368,{"date":162,"score":119,"percentile":160},"2026-07-11",{"date":164,"score":119,"percentile":157},"2026-07-12",{"date":166,"score":119,"percentile":167},"2026-07-13",0.02362,{"date":169,"score":119,"percentile":167},"2026-07-14",{"date":171,"score":119,"percentile":172},"2026-07-15",0.02356,{"date":174,"score":119,"percentile":175},"2026-07-16",0.02364,{"date":177,"score":119,"percentile":157},"2026-07-17",{"date":179,"score":119,"percentile":157},"2026-07-18",{"date":181,"score":119,"percentile":182},"2026-07-19",0.02366,{"date":184,"score":119,"percentile":185},"2026-07-20",0.02363,{"date":187,"score":119,"percentile":188},"2026-07-21",0.02374,{"date":190,"score":119,"percentile":191},"2026-07-22",0.02384,{"date":193,"score":119,"percentile":194},"2026-07-23",0.02382,{"date":196,"score":119,"percentile":197},"2026-07-24",0.0237,{"date":199,"score":119,"percentile":200},"2026-07-25",0.02371,{"date":202,"score":119,"percentile":197},"2026-07-26",{"date":204,"score":119,"percentile":200},"2026-07-27",{"date":206,"score":119,"percentile":157},"2026-07-28",{"date":208,"score":119,"percentile":209},"2026-07-29",0.02369,{"date":211,"score":119,"percentile":160},"2026-07-30",{"date":213,"score":119,"percentile":209},"2026-07-31",{"date":215,"score":119,"percentile":182},"2026-08-01",{"date":217,"score":119,"percentile":218},"2026-08-02",0.02365,{"date":220,"score":119,"percentile":221},"2026-08-03",0.0236,{"date":223,"score":119,"percentile":221},"2026-08-04",{"date":225,"score":119,"percentile":226},"2026-08-05",0.02359,{"date":228,"score":119,"percentile":172},"2026-08-06",{"date":230,"score":231,"percentile":232},"2026-08-07",0.00131,0.0307,{"date":234,"score":231,"percentile":235},"2026-08-08",0.03066,{"date":237,"score":231,"percentile":238},"2026-08-09",0.03065,{"date":240,"score":231,"percentile":241},"2026-08-10",0.03068,{"date":243,"score":231,"percentile":235},"2026-08-11",{"date":245,"score":246,"percentile":247},"2026-08-12",0.00147,0.04449,{"date":249,"score":246,"percentile":250},"2026-08-13",0.04452,{"date":252,"score":246,"percentile":253},"2026-08-14",0.04473,{"date":255,"score":246,"percentile":256},"2026-08-15",0.0446,{"date":258,"score":246,"percentile":259},"2026-08-16",0.04433,{"date":261,"score":246,"percentile":250},"2026-08-17",{"date":263,"score":246,"percentile":264},"2026-08-18",0.04461,{"date":266,"score":246,"percentile":267},"2026-08-19",0.04467,{"date":269,"score":246,"percentile":270},"2026-08-20",0.04474,{"date":272,"score":246,"percentile":273},"2026-08-21",0.04463,{"date":275,"score":246,"percentile":276},"2026-08-22",0.04466,{"date":278,"score":246,"percentile":279},"2026-08-23",0.04447,{"date":281,"score":246,"percentile":282},"2026-08-24",0.04177,{"date":284,"score":246,"percentile":285},"2026-08-25",0.04199,{"date":287,"score":246,"percentile":288},"2026-08-26",0.04203,{"date":290,"score":246,"percentile":291},"2026-08-27",0.04265,{"date":293,"score":246,"percentile":294},"2026-08-28",0.04242,{"date":296,"score":246,"percentile":297},"2026-08-29",0.04257,{"date":299,"score":51,"percentile":300},"2026-08-30",0.12637,{"date":302,"score":51,"percentile":303},"2026-08-31",0.12634,{"date":305,"score":51,"percentile":306},"2026-09-01",0.12647,{"date":308,"score":51,"percentile":309},"2026-09-02",0.12651,{"date":311,"score":51,"percentile":306},"2026-09-03",{"date":313,"score":51,"percentile":314},"2026-09-04",0.12664,{"date":316,"score":51,"percentile":317},"2026-09-05",0.12695,{"date":319,"score":51,"percentile":320},"2026-09-06",0.1271,{"date":322,"score":51,"percentile":323},"2026-09-07",0.12706,{"date":325,"score":51,"percentile":317},"2026-09-08",{"date":327,"score":51,"percentile":328},"2026-09-09",0.12751,{"date":330,"score":51,"percentile":331},"2026-09-10",0.12745,{"date":333,"score":51,"percentile":334},"2026-09-11",0.12746,{"date":336,"score":51,"percentile":337},"2026-09-12",0.1286,{"date":339,"score":51,"percentile":340},"2026-09-13",0.12815,{"date":342,"score":51,"percentile":343},"2026-09-14",0.1283,{"date":345,"score":51,"percentile":346},"2026-09-15",0.12885,{"date":348,"score":51,"percentile":349},"2026-09-16",0.12928,{"date":351,"score":51,"percentile":352},"2026-09-17",0.12968,{"date":354,"score":51,"percentile":355},"2026-09-18",0.13099,{"date":114,"score":51,"percentile":115},[358,363],{"source":55,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":359,"cvss_v4_0":9},{"baseScore":53,"baseSeverity":360,"vectorString":56,"impactScore":361,"exploitabilityScore":362},"HIGH",7.8,5.1,{"source":61,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":364,"cvss_v4_0":9},{"baseScore":53,"baseSeverity":360,"vectorString":56,"impactScore":361,"exploitabilityScore":362},[366,373],{"ecosystem":9,"name":367,"vendor":367,"product":367,"cpe_part":368,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":369},"kubevirt","a",[370],{"version":371,"is_range":49,"range_type":372,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"na","cpe",{"ecosystem":9,"name":374,"vendor":375,"product":376,"cpe_part":368,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":377},"openshift virtualization","redhat","openshift_virtualization",[378],{"version":379,"is_range":380,"range_type":372,"version_start":381,"version_start_type":382,"version_end":383,"version_end_type":382,"fixed_in":9},"gte4_lte4.22.0",true,"4","including","4.22.0"]