EUVD-2026-59919

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: terraform-provider-acme, argo-workflows, sriov-network-device-plugin, pulumi-language-java, gitlab-runner, kitty, argo-rollouts, fscrypt, crossplane-provider-family-aws, crossplane-provider-keycloak, grafana-rollout-operator, kubeflow-pipelines, otel-cli,...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2023-1547 vulnerabilities

Vulnerabilities for packages: helm...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: kots, zot, chartmuseum, k9s, flux-source-controller, kubescape, cluster-api-helm-controller, rancher-helm, helm-docs, cert-manager-cmctl, flux-helm-controller, helm-operator, zarf, k8ssandra-client, chart-testing, eksctl, cilium-cli, tw, trivy, helm-push, flux, pluto...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: kots, zot, kargo, chartmuseum, k9s, k8sgpt, flux-source-controller, cerbos, cluster-api-helm-controller, rancher-helm, helm-docs, cert-manager-cmctl, flux-helm-controller, helm-operator, zarf, k8ssandra-client, chart-testing, envoy-gateway, istio, eksctl,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: wal-g, grafana-rollout-operator, fulcio, ratify, k8sgpt, tekton-chains, cis-operator, nri-haproxy, cerbos, kpt, opa, helm-operator, cloud-provider-vsphere, swagger, kuberlr, thanos-operator, rabbitmq-default-user-credential-updater, oauth2-proxy, cilium-cli, glow,...

CVE-2026-19281

CVE-2026-19281 affects the project adolfosalasgomez3011 slidev-builder-mcp version 2.1.0. The vulnerability lies in the function generateChart within the file src/tools/generateAssets.ts of the generateAssets Tool . Manipulating the argument outputDir can trigger a command injection . Exploitatio...

CVE-2026-10090

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-10090 Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-10090

The CVE concerns Red Hat ACM’s multicluster-operators-subscription: a namespace-scoped edit user in the ACM hub can create a Channel to a Helm repo they control and a Subscription referencing it. The app-subscription controller then fetches and applies the Helm chart with its own elevated authori...

EUVD-2026-53294

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-10090 Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-10090

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-6972

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-6972

The CVE-2026-6972 entry concerns the SKT Skill Bar WordPress plugin (

CVE-2026-6972 SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-6972

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...