Kyverno versions 1.14.0 through 1.19.0 contain a vulnerability in the ImageValidatingPolicy evaluator where it fails to properly read the spec.images and spec.allowedValues fields of a PolicyException. This causes image signature verification to be skipped for all images in a matched resource when an exception is intended only for specific images, allowing unsigned or untrusted images to be admitted without verification. The issue is resolved in version 1.19.1.