PT-2026-78032

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Gantt Chart component of the Oracle Agile PLM product within Oracle Supply Chain. A low privileged attacker with access to the infrastructure where the software executes can...

CVE-2026-71041: Improper Access Control

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Gantt Chart. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agi...

BIT-SUPERSET-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

PT-2026-73438

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

EUVD-2026-59919

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726 Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before version 4.0.7 contains an incorrect authorization vulnerability. It fails to properly restrict access to chart configurations, enabling users with the Contributor role and above to view the full configuration of any chart on the site. This includes configura...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

PT-2026-73127

Name of the Vulnerable Software and Affected Versions Visualizer versions prior to 4.0.7 Description Insufficient authorization in the plugin allows users with the Contributor role and above to read the full configuration of any chart on the site. This includes charts that the interface normally...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, policy-controller, terraform-provider-azuread, timoni, vault-secrets-webhook, secrets-store-csi-driver-provider-aws, rancher-system-agent, terraform-provider-sendgrid, docker-machine-driver-linode, flux-source-controller, grype,...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2023-1547 vulnerabilities

Vulnerabilities for packages: helm...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: k9s, helm-push, k8ssandra-client, zarf, rancher-helm, flux-source-controller, helm-docs, flux-helm-controller, zot, chartmuseum, tw, trivy, kots, helm-operator, eksctl, pluto, kubescape, cluster-api-helm-controller, chart-testing, cert-manager-cmctl, flux, cilium-cli...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: k9s, k8sgpt, helm-push, k8ssandra-client, envoy-gateway, zarf, rancher-helm, flux-source-controller, linkerd2, helm-docs, flux-helm-controller, zot, chartmuseum, tw, trivy, kots, helm-operator, rancher-fleet, eksctl, istio, pluto, kargo, cluster-api-helm-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, kor, rancher-system-agent, opentofu, tflint, aws-eks-pod-identity-agent, nri-haproxy, terraform, wgcf, kubernetes-csi-external-health-monitor, harbor-cli, undock, kyverno-notation-aws, conftest, prometheus-operator, step-kms-plugin,...

CVE-2026-19281

CVE-2026-19281 affects the project adolfosalasgomez3011 slidev-builder-mcp version 2.1.0. The vulnerability lies in the function generateChart within the file src/tools/generateAssets.ts of the generateAssets Tool . Manipulating the argument outputDir can trigger a command injection . Exploitatio...

CVE-2026-19110: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...

PT-2026-68679

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 5.0.0 Description Cross site scripting occurs in the Chart Name Handler component due to improper handling of the Title argument within the HtmlTplDashboardWidgetHtmlRenderer function of the...