Rucio Helm Charts 日志信息泄露漏洞

Rucio Helm Charts is a library for Rucio in the rucio open source. Rucio Helm Charts suffers from a log message disclosure vulnerability that stems from logging X-Rucio-Auth-Token, which could lead to credential disclosure...

CVE-2025-53836: Incorrect Authorization

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricte...

BIT-HELM-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

SUSE CVE-2025-53547

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

CVE-2025-53547 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, flux, tw, helm-operator-fips, harbor-fips, eksctl, flux-fips, chartmuseum, envoy-gateway, consul-k8s, flux-helm-controller, helm-docs, flux-helm-controller-fips, cerbos-fips, zot, linkerd2-fips, trivy-fips, trivy, zarf, kargo, k8sgpt, cerbos,...

GHSA-557J-XG8C-Q2MM vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, flux, tw, helm-operator-fips, harbor-fips, eksctl, flux-fips, chartmuseum, envoy-gateway, consul-k8s, flux-helm-controller, helm-docs, flux-helm-controller-fips, cerbos-fips, zot, linkerd2-fips, trivy-fips, trivy, zarf, kargo, k8sgpt, cerbos,...

Local Code Execution (LCE)

helm.sh/helm/v3 is vulnerable to Local Code Execution LCE. The vulnerability is due to insufficient validation and sanitization of the Chart.yaml and Chart.lock files during dependency updates, allowing a maliciously crafted file to trigger local code execution...

CVE-2025-53547

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

Helm 代码注入漏洞

Helm is a Kubernetes package manager from the CNCF Foundation. A code injection vulnerability exists in Helm versions prior to 3.18.4 that stems from specially crafted Chart.yaml and Chart.lock files that could lead to native code execution...

The vulnerability of the data visualization plugin in the Grafana XY Chart Plugin system arises from the lack of security measures taken to protect the structure of the web page. This allows attackers to execute DOM-based XSS attacks.

The vulnerability of the data visualization plugin in the Grafana XY Chart Plugin exists due to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute a DOM-based XSS attack remotely...

MAL-2025-5134 Malicious code in solana-chart (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in solana-chart (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Security update for helm-mirror

This update for helm-mirror fixes the following issues: CVE-2025-32386: Fixed denial of service due to memory exhaustion after loading a specially crafter chart bsc1241028 CVE-2025-32387: Fixed stack overflow due to parser recursion that can exceed the stack size limit bsc1241031 Patch...

@mwater/visualization (>=5.4.0, <=5.7.0), azharimm-ui (>=1.0.0, <=1.0.2) +2 more potentially affected by CVE-2025-49223 via billboard.js (>=3.1.5, <=3.14.0)

billboard.js NPM version =3.1.5, =5.4.0, =1.0.0, =2.0.180, =2.4.42 - vuero 2.2.0 Source cves: CVE-2025-49223 Source advisory: OSV:GHSA-65P9-J6PG-72HJ...

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

...

CVE-2024-52599

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a...

CVE-2024-52799

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

CVE-2024-3674

The Inline Google Spreadsheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gdoc' shortcode in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping on user supplied attributes such as 'chartresolution'...

CVE-2024-40060

go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas function...

CVE-2023-47526

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allows Stored XSS.This issue affects Chartify – WordPress Chart Plugin: from n/a through 2.0.6...