https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-53492.htmlhttps://patchthecve.com/cve/CVE-2026-53492.htmlThu, 02 Jul 2026 19:33:00 +0000CRITICAL 9.6: containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoihttps://patchthecve.com/cve/CVE-2026-53489.htmlhttps://patchthecve.com/cve/CVE-2026-53489.htmlThu, 02 Jul 2026 19:33:12 +0000MEDIUM 6.5: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has https://patchthecve.com/cve/CVE-2026-50195.htmlhttps://patchthecve.com/cve/CVE-2026-50195.htmlThu, 02 Jul 2026 19:43:59 +0000CRITICAL 9.9: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can uhttps://patchthecve.com/cve/CVE-2026-47262.htmlhttps://patchthecve.com/cve/CVE-2026-47262.htmlThu, 02 Jul 2026 19:40:45 +0000MEDIUM 5.5: containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Ohttps://patchthecve.com/cve/CVE-2026-46680.htmlhttps://patchthecve.com/cve/CVE-2026-46680.htmlFri, 03 Jul 2026 04:17:53 +0000HIGH 7.8: containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etchttps://patchthecve.com/cve/CVE-2026-53488.htmlhttps://patchthecve.com/cve/CVE-2026-53488.htmlFri, 03 Jul 2026 04:17:55 +0000HIGH 8.8: containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a