kube-linter

Static analysis for Kubernetes What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you...

vapi

vAPI vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises. Requirements PHP MySQL PostMan MITM Proxy Installation Docker docker-compose up -d Installation Manual Copying the Code cd git clone...

stackrox

Tabla de Contenidos Plataforma de Seguridad Kubernetes de StackRox Tabla de Contenidos Comunidad Despliegue de StackRox Instalación Rápida usando Helm Instalación Manual usando Helm Instalación usando el Operador Instalación mediante Scripts Distribuciones de Kubernetes EKS, AKS, GKE OpenShift...

Important: Red Hat Security Advisory: Helm CLI for Red Hat OpenShift v4.3.0 release

General availability release of Helm CLI for Red Hat OpenShift v4.3.0. Helm is the package manager for Kubernetes, used to define, install, and upgrade applications as reusable charts. This release delivers the Helm CLI for Red Hat OpenShift v4.3.0 binaries built and distributed by Red Hat...

kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the...

ai-kubernetes-helm-chart-security

IA en Kubernetes: valores predeterminados de seguridad de los Helm charts evidencia Este repositorio contiene los datos y la evidencia que respaldan el informe técnico de Sorami "AI on Kubernetes: 10 of 14 Helm charts ship with no API auth" versión 1.2. Lea el informe aquí:...

CVE-2026-93537

SUSE Rancher Fleet is vulnerable to a path traversal vulnerability in the Helm valuesFiles component. An attacker with permission to supply bundle content to a GitRepo resource (e.g., via Git push access) can force the system to read arbitrary files from the filesystem of the bundle-processing en...

gha-lab-5511dc3f73

Artefacto de investigación automatizado — no es el proyecto original. Este repositorio es un laboratorio desechable construido por un sistema automatizado para una tesis de maestría en la Université Laval sobre la reproducción de vulnerabilidades publicadas en flujos de trabajo de GitHub Actions...

gha-lab-8aba6b05dc

Artefacto de investigación automatizado — no es el proyecto original. Este repositorio es un laboratorio desechable construido por un sistema automatizado para una tesis de maestría en la Université Laval sobre la reproducción de vulnerabilidades publicadas en flujos de trabajo de GitHub Actions...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: kubevela, nerdctl, buildkitd, zarf, kaniko, fuse-overlayfs-snapshotter, dagger, gatekeeper, falco-no-driver, zot, chartmuseum, helm-mapkubeapis, helm-push, docker-compose, kubescape-operator, rancher, kube-arangodb, neuvector-scanner, rancher-helm, grype, spegel, syf...

CVE-2025-14269

CVE-2025-14269 Se descubrió un problema de seguridad en la versión dentro del clúster de Headlamp donde usuarios no autenticados pueden reutilizar credenciales en caché para acceder a la funcionalidad de Helm a través de la interfaz de usuario de Headlamp. Los clústeres de Kubernetes solo se ven...

chart-down

chart-down Download and scan Helm charts for secrets using TruffleHog. Given a Helm repository URL, chart-down fetches the repo index, downloads every chart archive, extracts it, and runs TruffleHog against the contents. Requisitos Go 1.19+ TruffleHog en PATH brew install trufflehog Instalación g...

helm-plugin-path-traversal-security-assessment

CVE-2026-35204 - Escritura Arbitraria de Archivos por Path Traversal en Plugin de Helm Informe de Ciberseguridad Estilo Consultor Informe profesional de evaluación de vulnerabilidades para el riesgo de path traversal en plugins de Helm, que incluye análisis técnico, impacto, remediación y...

CVE-2025-53547-POC

PoC de CVE-2025-53547 esta es una prueba de concepto para CVE-2025-53547 Chart.lock enlaza el archivo de prueba a /tmp/1.txt /tmp/1.txt inyecta un comando que crea /tmp/2.txt En un entorno real de producto, puedes cambiar el archivo de enlace Chart.lock para inyectar cualquier comando que desees,...

CLEANSTART-2026-YE46626 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the helm-operator package. Previously, a channel registered in the mux's chanList is not usable until it is established...

OPENSUSE-SU-2026:11875-1 helm-4.3.0-3.1 on GA media

These are all security issues fixed in the helm-4.3.0-3.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-35204

CVE-2026-35204 此仓库代表 CVE-2026-35204 的概念验证 PoC。 描述 "Helm 是 Kubernetes 的 Charts 包管理器。从 4.0.0 到 4.1.3 版本，一个特制的 Helm 插件在安装或更新时，会使得 Helm 将插件内容写入任意文件系统位置。为了防止此问题，需要验证 Helm 插件的 plugin.yaml 中 version: 字段是否包含 POSIX 点-点路径分隔符，即 "/../"。此漏洞已在 4.1.4 版本中修复。" 此 PoC 演示了 metadata.Version 被用于构造插件归档的路径，从而允许路径穿越，并将下载...

OPENSUSE-SU-2026:11848-1 helm-4.3.0-2.1 on GA media

These are all security issues fixed in the helm-4.3.0-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE-SU-2026:21434-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory OOM termination bsc1248093. - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output...

SUSE-SU-2026:21461-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory OOM termination bsc1248093. - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output...