CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: flux-source-controller, helm-push, helm-diff-fips, flux-source-controller-fips, kuma, zarf, cilium-cli, rancher-fleet, cert-manager-cmctl, flux, kots, gitlab-operator, zarf-fips, cert-manager-cmctl-fips, flux-fips, helm-diff, rancher-fleet-fips, gitlab-operator-fips...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: flux-source-controller, helm-push, helm-diff-fips, flux-source-controller-fips, kuma, zarf, cilium-cli, rancher-fleet, cert-manager-cmctl, flux, kots, gitlab-operator, zarf-fips, cert-manager-cmctl-fips, flux-fips, helm-diff, rancher-fleet-fips, gitlab-operator-fips...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: flux-source-controller, helm-push, helm-diff-fips, flux-source-controller-fips, kuma, zarf, cilium-cli, rancher-fleet, cert-manager-cmctl, flux, kots, gitlab-operator, zarf-fips, cert-manager-cmctl-fips, flux-fips, helm-diff, rancher-fleet-fips, gitlab-operator-fips...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: flux-source-controller, helm-push, helm-diff-fips, flux-source-controller-fips, kuma, zarf, cilium-cli, rancher-fleet, cert-manager-cmctl, flux, kots, gitlab-operator, zarf-fips, cert-manager-cmctl-fips, flux-fips, helm-diff, rancher-fleet-fips, gitlab-operator-fips...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: jfrog-cli, kubescape-server, flux-source-controller, helm-exporter, helm-push, trivy-operator, k8ssandra-client-fips, kube-arangodb, helm-mapkubeapis, k9s-fips, cluster-api-helm-controller, cert-manager-cmctl-fips, chart-testing-fips, cluster-api-helm-controller-fips...

SUSE CVE-2026-35204

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. To prevent this, validate that the plugin.yaml of the Helm plugin does not...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: go, ingress-nginx-controller, goreleaser, newrelic-infra-operator, nova, pluto, sftpgo-plugin-eventsearch, supercronic, clickhouse-operator, dkron, flux-image-reflector-controller, github-mcp-server, grafana-rollout-operator, rabbitmq-messaging-topology-operator,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: tigera-operator, kubernetes-csi-driver-nfs, falcoctl, rancher-machine, weaviate, cloud-provider-aws, kube-arangodb, flux-helm-controller, apko, kaf, step-ca, external-dns, cert-manager-cmctl, spire-server, fuse-overlayfs-snapshotter, kine, act, argo-cd,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: tigera-operator, kubeflow-katib, weaviate, flux-helm-controller, kserve-modelmesh-serving, cloud-provider-azure, kine, rancher-loglevel, spicedb-operator, terraform-provider-sendgrid, yunikorn-k8shim, timescaledb-parallel-copy, aws-s3-controller, kuberlr,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, kubernetes-csi-driver-nfs, falcoctl, sftpgo, cloudnative-pg, kubeflow-katib, rancher-machine, opentelemetry-operator, weaviate, cloud-provider-aws, kube-arangodb, kubernetes-csi-livenessprobe, flux-helm-controller, terraform-provider-azurea...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: jfrog-cli, kubescape-server, flux-source-controller, helm-exporter, helm-push, trivy-operator, k8ssandra-client-fips, kube-arangodb, helm-mapkubeapis, k9s-fips, cluster-api-helm-controller, cert-manager-cmctl-fips, chart-testing-fips, cluster-api-helm-controller-fips...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, kyverno-fips, jaeger-fips, beats, caddy, cloud-provider-aws-fips, mailpit, seaweedfs-fips, backup-restore-operator-fips, docker-cli-buildx, flux-helm-controller, falcoctl-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, kyverno-fips, jaeger-fips, beats, caddy, cloud-provider-aws-fips, mailpit, seaweedfs-fips, backup-restore-operator-fips, docker-cli-buildx, flux-helm-controller, falcoctl-fips,...

OPENSUSE-SU-2026:10532-1 helm3-3.20.2-1.1 on GA media

These are all security issues fixed in the helm3-3.20.2-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-35205

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a malicious plugin that lacks a provenance file. Even when signature verification is enabled, Helm would incorrectly install this unverified plugin, bypassing critical...

CVE-2026-35204

A flaw was found in Helm, a package manager for Kubernetes. An attacker could exploit this vulnerability by providing a specially crafted Helm plugin. When such a plugin is installed or updated, Helm incorrectly processes its configuration, allowing the plugin's contents to be written to an...

GHSA-HR2V-4R36-88HR Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions /, instead of the expected //, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes as if to refer to parent directories do not resolve beyond the...

EUVD-2026-21100

Helm Chart extraction output directory collapse via Chart.yaml name dot-segment...

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions /, instead of the expected //, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes as if to refer to parent directories do not resolve beyond the...

Failing Open

Overview Affected versions of this package are vulnerable to Failing Open in plugin installation, when signature verification is required, but the .prov file is missing. An attacker can execute arbitrary code by providing a malicious plugin archive that omits provenance data, thereby bypassing...