CVE-2026-71041: Improper Access Control

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Gantt Chart. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agi...

BIT-SUPERSET-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

PT-2026-73438

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

CVE-2026-19726 Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before version 4.0.7 contains an incorrect authorization vulnerability. It fails to properly restrict access to chart configurations, enabling users with the Contributor role and above to view the full configuration of any chart on the site. This includes configura...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

EUVD-2026-59919

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

PT-2026-73127

Name of the Vulnerable Software and Affected Versions Visualizer versions prior to 4.0.7 Description Insufficient authorization in the plugin allows users with the Contributor role and above to read the full configuration of any chart on the site. This includes charts that the interface normally...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: gitness, external-dns, dapr, litestream, kubernetes-dashboard-web, smarter-device-manager, sftpgo-plugin-geoipfilter, kyverno-notation-aws, cloudprober, k6, minio-object-browser, knative-eventing, octo-sts, cosign, crossplane-provider-aws-sns, dbmate, argo-cd,...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2023-1547 vulnerabilities

Vulnerabilities for packages: helm...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: zarf, kubescape, trivy, chartmuseum, k8ssandra-client, helm-push, flux-source-controller, k9s, cilium-cli, helm-docs, flux, helm-operator, zot, cert-manager-cmctl, chart-testing, tw, kots, eksctl, pluto, rancher-helm, flux-helm-controller, cluster-api-helm-controller...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: kargo, rancher-fleet, cerbos, zarf, trivy, chartmuseum, k8ssandra-client, linkerd2, helm-push, flux-source-controller, istio, k9s, cilium-cli, helm-docs, helm-operator, zot, cert-manager-cmctl, k8sgpt, chart-testing, tw, kots, eksctl, pluto, rancher-helm,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-web, gptscript, kyverno-notation-aws, kapp, nri-memcached, grafana-alloy, aws-privateca-issuer, libnvidia-container, aws-eks-pod-identity-agent, helm-push, step-kms-plugin, flux, rancher-system-upgrade-controller, aws-application-networking-k8s,...

CVE-2026-19281

CVE-2026-19281 affects the project adolfosalasgomez3011 slidev-builder-mcp version 2.1.0. The vulnerability lies in the function generateChart within the file src/tools/generateAssets.ts of the generateAssets Tool . Manipulating the argument outputDir can trigger a command injection . Exploitatio...

PT-2026-68679

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 5.0.0 Description Cross site scripting occurs in the Chart Name Handler component due to improper handling of the Title argument within the HtmlTplDashboardWidgetHtmlRenderer function of the...

CVE-2026-19110: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...

Malicious code in dolyame-ui-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9 On require of the package, index.js loads shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded...