Security update for helm

This update for helm fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276510. CVE-2026-63308: processing zero-length byte slices in...

SUSE-SU-2026:3882-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276510. - CVE-2026-63308: processing zero-length byte slices in...

CVE-2026-82878

DataEase versions before 2.10.26 lack object-level authorization checks on REST endpoints for geographic information , dashboard linkage , and chart detail . This allows any authenticated user to access, overwrite, or delete resources belonging to other users by supplying arbitrary identifiers in...

CVE-2026-63135

YOURLS (self-hosted PHP URL shortener) versions 1.5.1 through 1.10.4 are affected by a stored cross-site scripting (XSS) vulnerability in the referrer statistics chart. The root cause is that the chart builder concatenates referrer-derived domain labels into inline JavaScript without proper strin...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-71041

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Gantt Chart. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agi...

EUVD-2026-61988

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Gantt Chart. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agi...

PT-2026-78032

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Gantt Chart component of the Oracle Agile PLM product within Oracle Supply Chain. A low privileged attacker with access to the infrastructure where the software executes can...

BIT-SUPERSET-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 has a broken access control flaw: any user with the Contributor role or above can retrieve every chart's full configuration in a single request, potentially exposing remote data source credentials stored in chart settings. CVSS 3.1 scores this MEDIUM (...

EUVD-2026-59919

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: grpcurl, flux-source-controller, istio, kubernetes-csi-external-provisioner, minio, step, falcoctl, crossplane-provider-aws-cloudformation, crossplane-provider-sql, crossplane-provider-aws-s3, golangci-lint, kserve-rest-proxy, volume-modifier-for-k8s, k8sgateway,...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2023-1547 vulnerabilities

Vulnerabilities for packages: helm...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: flux-source-controller, zot, helm-operator, k8ssandra-client, cert-manager-cmctl, flux, k9s, cluster-api-helm-controller, zarf, helm-docs, kots, chart-testing, cilium-cli, chartmuseum, tw, trivy, kubescape, flux-helm-controller, helm-push, eksctl, rancher-helm, pluto...