containerd

Every one of the 26 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Insecure handling of image volumes in containerd CRI pluginCVE-2022-23648containerd · CVSS 7.5 · 27% likely

   CWE-200

2. containerd-shim API Exposed to Host Network ContainersCVE-2020-15257containerd · CVSS 5.2 · 3.1% likely

   CWE-669

3. containerd can be coerced into leaking credentials during image pullCVE-2020-15157containerd · CVSS 6.1 · 2.3% likely

   CWE-522

4. environment variable leakCVE-2021-21334containerd · CVSS 6.3 · 1.9% likely

   CWE-668

5. Improper Preservation of Permissions in containerdCVE-2021-43816containerd · CVSS 8 · 1.8% likely

   CWE-281

6. Archive package allows chmod of file outside of unpack target directoryCVE-2021-32760containerd · CVSS 5 · 1.6% likely

   CWE-668

7. containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leakCVE-2022-23471containerd · CVSS 5.7 · 1.1% likely

   CWE-400

8. containerd supplementary groups are not set up properlyCVE-2023-25173containerd · CVSS 5.3 · 0.5% likely

   CWE-863

9. Insufficiently restricted permissions on plugin directoriesCVE-2021-41103containerd · CVSS 5.9 · 0.5% likely

   CWE-22

10. Containerd vulnerable to host filesystem access during image unpackCVE-2025-47290containerd · CVSS 7.6 · 0.5% likely

    CWE-367

11. containerd CRI plugin: Host memory exhaustion through ExecSyncCVE-2022-31030containerd · CVSS 5.5 · 0.4% likely

    CWE-400

12. containerd OCI image importer memory exhaustionCVE-2023-25153containerd · CVSS 6.2 · 0.4% likely

    CWE-770

13. Containerd has image-pull DoS via crafted OCI index graph amplificationCVE-2026-53493containerd · CVSS 6.9 · 0.4% likely

    CWE-770

14. containerd CRI checkpoint restore CDI annotation smugglingCVE-2026-53492containerd · CVSS 8.4 · 0.4% likelycovered by CyberSIXT

    CWE-863

15. containerd has an integer overflow in User ID handlingCVE-2024-40635containerd · CVSS 4.6 · 0.3% likely

    CWE-190

16. containerd: CRI checkpoint import allows local image tag poisoningCVE-2026-50195containerd · CVSS 5.6 · 0.3% likelycovered by CyberSIXT

    CWE-345

17. containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.CVE-2025-47291containerd · CVSS 4.6 · 0.3% likely

    CWE-266

18. containerd image-triggered runtime DoS via unbounded group parsingCVE-2026-47262containerd · CVSS 5.3 · 0.3% likely

    CWE-400

19. containerd: Unpack DoS via repeated opaque whiteoutsCVE-2026-95838containerd · CVSS 4.6 · 0.2% likely

    CWE-407

20. containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pullCVE-2026-53488containerd · CVSS 9.4 · 0.2% likelycovered by CyberSIXT

    CWE-20

21. containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreCVE-2026-53489containerd · CVSS 8.2 · 0.2% likely

    CWE-61

22. containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329containerd · CVSS 6.9 · 0.2% likely

    CWE-401

23. containerd affected by a local privilege escalation via wide permissions on CRI directoryCVE-2024-25621containerd · CVSS 7.3 · 0.2% likely

    CWE-279

24. containerd user ID handling bypass allows runAsNonRoot evasionCVE-2026-46680containerd · CVSS 7.3 · 0.2% likely

    CWE-269

25. containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of ServiceCVE-2026-53495containerd · CVSS 6.8 · 0.2% likely

    CWE-400

26. containerd CRI plugin: Checkpoint restore bypasses destination security contextCVE-2026-95837containerd · CVSS 7.8 · 0.1% likely

    CWE-269

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.