Containerd
Vulnerability activity for Containerd: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.2HighJul 1, 2026containerd Path traversal / file handlingCVE-2026-53489containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has
- 8.4HighJul 1, 2026containerdCVE-2026-53492containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoi
- 5.6MediumJul 1, 2026containerd Auth bypass / access controlCVE-2026-50195containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can u
- 5.3MediumJul 1, 2026containerd Denial of serviceCVE-2026-47262containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an O
- 9.4CriticalJul 1, 2026containerdCVE-2026-53488containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a
Top products
- containerd5 CVEs in the last year, 1 critical
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Google Kubernetes Engine · Jun 18, 2026GCP-2026-037CVE-2026-47262CVE-2026-50195CVE-2026-53488CVE-2026-53489CVE-2026-53492
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.