[CVE-2026-63209 ] Published: Sep 29, 2026, 2:58:53 PM UTC
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a d
High(7.5) Affected Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Affected · Fixed: 3.22.0-3.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-3.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-3.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-3.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-81871 ] Published: Sep 16, 2026, 8:43:40 PM UTC
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIF
Medium(6.5) Affected Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Affected · Fixed: 3.22.0-2.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-85731 ] Published: Sep 16, 2026, 4:24:48 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directo
High(8.8) Affected Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Affected · Fixed: 3.22.0-1.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.0-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-84303 ] Published: Sep 1, 2026, 6:14:37 PM UTC
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher e
Critical(9.1) Affected Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Affected · Fixed: 3.21.3-8.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-8.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-8.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-8.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-37236 ] Published: Aug 28, 2026, 12:00:00 AM UTC
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST reque
Critical(9.8) Affected Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Affected · Fixed: 3.21.3-7.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-7.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-7.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-7.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-78669 ] Published: Aug 13, 2026, 9:43:54 PM UTC
Go vulnerabilities
Critical(9.1) Affected Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Affected · Fixed: 3.22.1-1.1
usn · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.1-1.1
Version impact unknown
usn · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.1-1.1
Version impact unknown
usn · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.22.1-1.1
Version impact unknown
usn · helm3 · opensuse · tumbleweed
[CVE-2026-63308 ] Published: Jul 17, 2026, 4:14:15 PM UTC
helm-4.2.3-4.1 on GA media
Medium(4.3) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.21.3-4.1
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-4.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-4.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-4.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
[CVE-2026-56852 ] Published: Jul 14, 2026, 5:29:56 PM UTC
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
High(7.5) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.21.3-3.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-3.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-3.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-3.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-48978 ] Published: Jul 1, 2026, 9:35:45 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowi
Low(3.1) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.21.2-2.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.2-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.2-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.2-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-50151 ] Published: Jul 1, 2026, 9:35:45 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolit
High(7.5) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.21.3-2.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-2.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-41178 ] Published: Jun 4, 2026, 2:38:23 PM UTC
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log e
High(7.5) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.21.3-6.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-6.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-6.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.3-6.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-33814 ] Published: May 7, 2026, 7:21:40 PM UTC
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
High(7.5) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.21.0-1.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.0-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.0-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.21.0-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2026-35206 ] Published: Apr 9, 2026, 9:02:13 PM UTC
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's co
Medium(4.8) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.20.2-1.1
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.20.2-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.20.2-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.20.2-1.1
Version impact unknown
nvd · helm3 · opensuse · tumbleweed
[CVE-2025-55199 ] Published: Aug 13, 2025, 11:23:43 PM UTC
govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media
Medium(6.5) Unknown Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.20.0-2.1
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.20.0-2.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.20.0-2.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.20.0-2.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
[CVE-2018-16873 ] Published: Dec 14, 2018, 2:29:00 PM UTC
UBUNTU-CVE-2018-16873
High(7.5) Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:35:13 PM UTC
Details (4) 3.21.3-6.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.19.2-1.1
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.19.2-1.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.19.2-1.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
3.21.3-6.1 · noarch · tumbleweed
Unknown · Fixed: 3.19.2-1.1
Version impact unknown
pypi · helm3 · opensuse · tumbleweed
