CLEANSTART-2026-PF69993 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-1229, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27141, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598 applied in versions: 3.19.0-r0, 4.0.0-r0, 4.0.1-r0, 4.1.1-r1, 4.2.0-r1

Multiple security vulnerabilities affect the helm package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CL67452 Security fixes for CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-27145, CVE-2026-29181, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-35206, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, CVE-2026-46680, ghsa-fqw6-gf59-qr4w, ghsa-hfvc-g4fc-pqhx, ghsa-hr2v-4r36-88hr, ghsa-mh2q-q3fh-2475, ghsa-pc3f-x583-g7j2 applied in versions: 1.41.1-r0, 1.41.1-r1, 1.42.2-r0, 1.42.2-r1

Multiple security vulnerabilities affect the helm-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

Security Bulletin: Due to use of spring-web-6.2.17.jar, IBM Sterling Connect:Direct Web Services is vulnerable to allows an attacker to consume available disk space.

Summary spring-web-6.2.17.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-22740. Vulnerability Details CVEID:CVE-2026-22740 DESCRIPTION: A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp...

CVE-2026-45132

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow generate-schema.yaml exposes sensitive credentials Personal Access Token and SSH signing key to fork-controlled code due to unsafe checkout and credential handling practices. Th...

CVE-2026-45131

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow pull-request.yaml executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens...

Security update for helm (important)

openSUSE security update: security update for helm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20860-1 Rating: important References: bsc1265428 bsc1265758 Cross-References: CVE-2026-33814 CVE-2026-41888 CVSS scores: CVE-2026-33814 SUSE : 7.5...

Security Bulletin: Due to use of spring-webmvc-6.2.17.jar, IBM Sterling Connect:Direct Web Services is vulnerable to cache poisoning when resolving static resources.

Summary spring-webmvc-6.2.17.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-22741. Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: glab, grafana-pyroscope, hydra, fq, k3s, step, step-issuer, flux, karpenter, minio, hubble, traefik, crossplane-provider-azure-authorization, opentelemetry-collector, kine, gitea, kots, prometheus-operator, caddy, cilium, ingress-nginx-controller,...

CVE-2026-45132

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow generate-schema.yaml exposes sensitive credentials Personal Access Token and SSH signing key to fork-controlled code due to unsafe checkout and credential handling practices. Th...

EUVD-2026-33666

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow pull-request.yaml executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens...

CVE-2026-45131 CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow pull-request.yaml executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens...