https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40938.htmlhttps://patchthecve.com/cve/CVE-2026-40938.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argument to git fetch without any validation thahttps://patchthecve.com/cve/CVE-2026-40924.htmlhttps://patchthecve.com/cve/CVE-2026-40924.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.5: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant whttps://patchthecve.com/cve/CVE-2026-40923.htmlhttps://patchthecve.com/cve/CVE-2026-40923.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths https://patchthecve.com/cve/CVE-2026-40161.htmlhttps://patchthecve.com/cve/CVE-2026-40161.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.7: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL whhttps://patchthecve.com/cve/CVE-2026-25542.htmlhttps://patchthecve.com/cve/CVE-2026-25542.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.5: Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource source string (refSource.URI) against spec.resources[].pattern