CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: flux-source-controller, k9s, kube-arangodb, tw, helm, istio, harbor, kots, linkerd2, helm-docs, cerbos, envoy-gateway, kubescape, helm-mapkubeapis, chartmuseum, zot, kuma, eksctl, headlamp, cert-manager-cmctl, cluster-api-helm-controller, zarf, k8ssandra-client,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: flux-source-controller, k9s, kube-arangodb, tw, helm, istio, harbor, kots, linkerd2, helm-docs, cerbos, envoy-gateway, kubescape, helm-mapkubeapis, chartmuseum, zot, kuma, eksctl, headlamp, cert-manager-cmctl, cluster-api-helm-controller, zarf, k8ssandra-client,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: chart-testing-fips, zot, cerbos, cluster-api-helm-controller-fips, jfrog-cli, helm, trivy, trivy-fips, chaos-mesh-fips, linkerd2-fips, headlamp-fips, tw, teleport, zarf-fips, kube-arangodb, flux, cloudbeat, gitlab-operator, gitlab-operator-fips, chaos-mesh,...

EUVD-2026-21553

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:teamid/template/generate/:projectid. The GET handler calls checkAccessreq,...

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions /, instead of the expected //, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes as if to refer to parent directories do not resolve beyond the...

GHSA-HR2V-4R36-88HR Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions /, instead of the expected //, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes as if to refer to parent directories do not resolve beyond the...

CVE-2026-35206

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a specially crafted Chart to the helm pull --untar command. This would cause the Chart's contents to be written to an unintended directory, potentially overwriting existing...

Checkmk 安全漏洞

Checkmk is an IT monitoring platform developed by Checkmk Corporation. Versions of Checkmk prior to 2.5.0b4, 2.4.0p26, and 2.3.0p47 contain security vulnerabilities. These vulnerabilities stem from Livestatus injection in the prediction chart page, which may allow authenticated users to inject...

CVE-2026-35206

Helm is a package manager for Charts for Kubernetes. In Helm versions =3.20.1 and =4.1.3, a specially crafted Chart will cause helm pull --untar chart URL | repo/chartname to write the Chart's contents to the immediate output directory as defaulted to the current working directory; or as given by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the helm pull --untar chart URL | repo/chartname command. An attacker can cause files to be written to unintended directories, potentially overwriting existing files or placing malicious files in accessible...

CVE-2026-35206

CVE-2026-35206 affects Helm charts where, in versions ≤ 3.20.1 and ≤ 4.1.3, a specially crafted Chart can cause helm pull --untar to write the chart contents to the immediate output directory (current working directory or as set by --destination/--untardir) instead of the directory named after th...

CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions =3.20.1 and =4.1.3, a specially crafted Chart will cause helm pull --untar chart URL | repo/chartname to write the Chart's contents to the immediate output directory as defaulted to the current working directory; or as given by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the helm pull --untar chart URL | repo/chartname command. An attacker can cause files to be written to unintended directories, potentially overwriting existing files or placing malicious files in accessible...

CVE-2026-35206

Helm is a package manager for Charts for Kubernetes. In Helm versions =3.20.1 and =4.1.3, a specially crafted Chart will cause helm pull --untar chart URL | repo/chartname to write the Chart's contents to the immediate output directory as defaulted to the current working directory; or as given by...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the helm pull --untar chart URL | repo/chartname command. An attacker can cause files to be written to unintended directories, potentially overwriting existing files or placing malicious files in accessible...

CVE-2026-35206 Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions =3.20.1 and =4.1.3, a specially crafted Chart will cause helm pull --untar chart URL | repo/chartname to write the Chart's contents to the immediate output directory as defaulted to the current working directory; or as given by...

CVE-2026-35206

Helm is a package manager for Charts for Kubernetes. In Helm versions =3.20.1 and =4.1.3, a specially crafted Chart will cause helm pull --untar chart URL | repo/chartname to write the Chart's contents to the immediate output directory as defaulted to the current working directory; or as given by...

PT-2026-31732

Name of the Vulnerable Software and Affected Versions Helm versions 3.20.1 and earlier, and versions 4.1.3 and earlier Description Helm, a package manager for Kubernetes Charts, is affected by an issue where a specially crafted Chart can cause the helm pull --untar command to write chart contents...

WordPress SQL Chart Builder plugin < 2.3.8 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by dangnosuy in WordPress Plugin SQL Chart Builder versions 2.3.8...

EUVD-2026-19578

The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality...