CVE-2025-33093 IBM Sterling Partner Engagement Manager information disclosure

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

Security Bulletin: IBM Sterling Partner Engagement Manager has several issues with secrets management (CVE-2025-33093)

Summary IBM Sterling Partner Engagement Manager's JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret. This issue has been addressed in the latest Helm Chart. Vulnerability Details CVEID:CVE-2025-33093 DESCRIPTION: IBM Sterling Partner Engagement Manager's JWT secr...

PT-2025-20069

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.0 through 6.2.2 Description The issue concerns the storage of the JWT secret in public Helm Charts, rather than as a Kubernetes secret. This affects IBM Sterling Partner Engagement Manager...

CVE-2025-33093: Password in Configuration File

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret...

Microsoft Warns Default Helm Charts Could Leave Kubernetes Apps Exposed to Data Leaks

Microsoft has warned that using pre-made templates, such as out-of-the-box Helm charts, during Kubernetes deployments could open the door to misconfigurations and leak valuable data. "While these 'plug-and-play' options greatly simplify the setup process, they often prioritize ease of use over...

ROS-20250430-16

The package manager vulnerability for Kubernetes Helm is related to the creation of a diagram file in such a way, that it expands and becomes much larger in uncompressed form. Exploitation of the vulnerability could Allow an attacker acting remotely to cause a denial of service A package manager...

SUSE-SU-2025:20196-1 Security update for helm

This update for helm fixes the following issues: - Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates - Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: chec...

Security update for helm

This update for helm fixes the following issues: Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: check...

SUSE-SU-2025:20278-1 Security update for helm

This update for helm fixes the following issues: - Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates - Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: chec...

Security update for helm

This update for helm fixes the following issues: Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: check...

Denial Of Service (DoS)

helm.sh/helm/v3 is vulnerable to Denial Of Service DoS. The vulnerability is due to memory exhaustion due to specially crafted chart archives that decompress to a size significantly larger than their compressed form...

AZL-60572 CVE-2025-22872 affecting package helm for versions less than 3.15.2-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

AZL-60565 CVE-2025-22872 affecting package helm for versions less than 3.14.2-6

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

Security update for Multi-Linux Manager 5.0: Server, Proxy and Retail Server

Description: This update fixes the following issues: proxy-helm: Version 5.0.12: Image rebuilt to the newest version with updated dependencies proxy-httpd-image: Version 5.0.10: Fixed wrong IP address set on susemanager-tftpsync-recv.conf Image rebuilt to the newest version with updated...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, k9s, rancher-helm, helm-operator, chartmuseum, kubescape, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, chart-testing, cert-manager-cmctl, flux, flux-helm-controller, flux-source-controller, cilium-cli, tw, kots, zarf...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, k9s, rancher-helm, helm-operator, chartmuseum, kubescape, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, chart-testing, cert-manager-cmctl, flux, flux-helm-controller, flux-source-controller, cilium-cli, tw, kots, zarf...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, k9s, rancher-helm, helm-operator, chartmuseum, kubescape, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, chart-testing, cert-manager-cmctl, flux, flux-helm-controller, flux-source-controller, cilium-cli, tw, kots, zarf...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, k9s, rancher-helm, helm-operator, chartmuseum, kubescape, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, chart-testing, cert-manager-cmctl, flux, flux-helm-controller, flux-source-controller, cilium-cli, tw, kots, zarf...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: chartmuseum, kubescape, trivy, harbor-fips, helm-operator, consul-k8s, trivy-fips, cert-manager-cmctl-fips, chart-testing-fips, flux-helm-controller, k8ssandra-client, chart-testing, cluster-api-helm-controller-fips, cert-manager-cmctl, pluto, helm-push, flux-fips,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: chartmuseum, kubescape, trivy, harbor-fips, helm-operator, consul-k8s, trivy-fips, cert-manager-cmctl-fips, chart-testing-fips, flux-helm-controller, k8ssandra-client, chart-testing, cluster-api-helm-controller-fips, cert-manager-cmctl, pluto, helm-push, flux-fips,...