CVE-2025-2703

A DOM-based Cross-site scripting vulnerability exists in Grafana's built-in XY Chart plugin. This flaw allows an attacker with editor-level privileges to inject and execute arbitrary JavaScript code by editing an XY Chart Panel. The vulnerability bypasses the Content Security Policy, allowing the...

XSS in Grafana XY Chart Plugin

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript. This vulnerability first appeared in Grafana v11.1.0, and is fixed in 11.6.0+security-01, 11.5.3+security-01,...

Grafana 安全漏洞

Grafana is a set of open source monitoring tools from Grafana open source that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A security vulnerability exists in Grafana version v11.1.0, which stems from a...

PT-2025-17601 · Unknown +1 · Xy Chart Plugin +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The built-in XY Chart plugin is affected by a DOM XSS issue. A user with Editor permissions can modify a panel to execute arbitrary JavaScript. Recommendations: At the moment, there is no...

SUSE-SU-2025:20196-1 Security update for helm

This update for helm fixes the following issues: - Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates - Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: chec...

Security update for helm

This update for helm fixes the following issues: Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: check...

Denial Of Service (DoS)

helm.sh/helm/v3 is vulnerable to Denial Of Service DoS. The vulnerability is due to memory exhaustion due to specially crafted chart archives that decompress to a size significantly larger than their compressed form...

CVE-2025-3661 SB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The SB Chart block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-3661

CVE-2025-3661 describes a Stored Cross-Site Scripting in the WordPress SB Chart block plugin (versions up to and including 1.2.6) caused by insufficient input sanitization and output escaping of the className parameter. Exploitation requires authentication at Contributor level or higher, enabling...

WordPress SB Chart block plugin <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via className Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin SB Chart block versions = 1.2.6...

WordPress plugin SB Chart block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-17373 · WordPress · Sb Chart Block Plugin

Name of the Vulnerable Software and Affected Versions: SB Chart block plugin for WordPress versions up to, and including, 1.2.6 Description: The issue is related to Stored Cross-Site Scripting via the className parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: kots, helm-docs, k9s, kubescape, cilium-cli, tw, pluto, zarf, helm-operator, cluster-api-helm-controller, trivy, zot, rancher-helm, eksctl, helm-push, consul-k8s, chart-testing, chartmuseum, k8ssandra-client, flux-helm-controller, cert-manager-cmctl, flux,...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: kots, helm-docs, k9s, kubescape, cilium-cli, tw, pluto, zarf, helm-operator, cluster-api-helm-controller, trivy, zot, rancher-helm, eksctl, helm-push, consul-k8s, chart-testing, chartmuseum, k8ssandra-client, flux-helm-controller, cert-manager-cmctl, flux,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: kots, helm-docs, k9s, kubescape, cilium-cli, tw, pluto, zarf, helm-operator, cluster-api-helm-controller, trivy, zot, rancher-helm, eksctl, helm-push, consul-k8s, chart-testing, chartmuseum, k8ssandra-client, flux-helm-controller, cert-manager-cmctl, flux,...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: kots, helm-docs, k9s, kubescape, cilium-cli, tw, pluto, zarf, helm-operator, cluster-api-helm-controller, trivy, zot, rancher-helm, eksctl, helm-push, consul-k8s, chart-testing, chartmuseum, k8ssandra-client, flux-helm-controller, cert-manager-cmctl, flux,...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: trivy, flux-helm-controller-fips, flux-fips, k8ssandra-client-fips, eksctl, k8ssandra-client, zot, helm-docs, chart-testing, zarf, flux, trivy-fips, helm-push, chart-testing-fips, chartmuseum-fips, helm-operator, rancher-helm, harbor, cert-manager-cmctl-fips, tw, k9s...

BIT-HELM-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...

GHSA-5XQW-8HWV-WG92 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

A Helm contributor discovered that a specially crafted JSON Schema within a chart can lead to a stack overflow. Impact A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack...