https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-41485.htmlhttps://patchthecve.com/cve/CVE-2026-41485.htmlWed, 17 Jun 2026 10:46:46 +0000HIGH 7.7: Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller https://patchthecve.com/cve/CVE-2026-41323.htmlhttps://patchthecve.com/cve/CVE-2026-41323.htmlWed, 17 Jun 2026 10:46:30 +0000HIGH 8.1: Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has no vhttps://patchthecve.com/cve/CVE-2026-41068.htmlhttps://patchthecve.com/cve/CVE-2026-41068.htmlWed, 17 Jun 2026 10:46:07 +0000HIGH 7.7: Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating the `URLPath` field. However, the ConfigMap context loader has the identical vulnerability — the `confhttps://patchthecve.com/cve/CVE-2026-40868.htmlhttps://patchthecve.com/cve/CVE-2026-40868.htmlWed, 17 Jun 2026 10:45:47 +0000HIGH 8.1: Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because