GO-2026-4976 vulnerabilities

Vulnerabilities for packages: karpenter, kyverno, coredns, flux, dask-gateway, fluent-bit-plugin-loki, kube-fluentd-operator, nerdctl, trino, k3s, karma, falco-no-driver, aws-flb-firehose, telegraf, aws-flb-cloudwatch, kubevela, zot, kubo, aactl, istio, prometheus, aws-flb-kinesis, datadog-agent,...

GO-2026-5014 vulnerabilities

Vulnerabilities for packages: kyverno, flux, spire-server, nerdctl, k9s, kubescape, k3s, gitlab-kas, falco-no-driver, external-secrets-operator, skaffold, trivy-operator, telegraf, argocd-image-updater, zot, kine, snyk-cli, aactl, istio, prometheus, loki, flux-source-controller, containerd, kots,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: eksctl, conftest, redis-operator, bento, flux-kustomize-controller, mc, spire-server, goreleaser, traefik, dask-gateway, xeol, nerdctl, terraform-provider-pagerduty, helm-set-status, k3s, falco-no-driver, telegraf, opentofu, bom, aws-flb-cloudwatch, kine, kubo, cosig...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: bento, gogatekeeper, dask-gateway, nginx-prometheus-exporter, crossplane-provider-aws-rds, nerdctl, kyverno-policy-reporter-ui, minio-operator, helm-set-status, podinfo, lazygit, cloud-provider-vsphere, boring-registry, bom, ratify, kserve-modelmesh-serving, blobfuse...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: delve, tkn, nginx-prometheus-exporter, cerbos, aws-application-networking-k8s, helm-set-status, nuclei, cloud-provider-vsphere, ratify, bom, yunikorn-k8shim, rancher-system-upgrade-controller, ipfs-cluster, harbor-registry, opa, envconsul, trivy, kind, nri-apache, ko...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, k3d, flux-kustomize-controller, flux, rabbitmq-messaging-topology-operator, goreleaser, spire-server, tkn, vexctl, kargo, kubescape, neuvector-sigstore-interface, k3s, timestamp-authority, nuclei, opentelemetry-collector-contrib, guac,...

CLEANSTART-2026-TN09152 Security fixes in helm 4.2.3-r0

Package helm version 4.2.3-r0 fixes 1 vulnerabilities: CVE-2026-50163...

CLEANSTART-2026-TK72884 Security fixes in helm 3.21.1-r1

Package helm version 3.21.1-r1 fixes 4 vulnerabilities: CVE-2026-53488, ghsa-jpcc-p29g-p8mq, ghsa-xhf5-7wjv-pqxp, CVE-2026-47262...

CLEANSTART-2026-KJ07309 Security fixes in helm 4.2.1-r1

Package helm version 4.2.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CVE-2026-71473

The CVE-2026-71473 affects the search-v2-operator component in the ACM search-v2-operator workflow (Acm-search-v2-rhel9). Evidence from CVE records tied to CVELIST indicates a flaw where a user with specific administrative permissions on a managed cluster can inject arbitrary configuration data v...

CVE-2026-71473 Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke

A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container...

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016 Rendered Artifactory Helm manifests may contain generated TLS private keys

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

EUVD-2026-57259

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016 Rendered Artifactory Helm manifests may contain generated TLS private keys

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016

CVE-2026-66016 concerns rendered Artifactory Helm manifests produced under specific self-hosted Helm configurations, where generated TLS private keys may be retained and become accessible to highly privileged local users. The CVSS-derived metrics in the initial entry indicate local attack vector,...

CVE-2026-66016: Cleartext Storage of Sensitive Information

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

PT-2026-71123

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...