[CVE-2026-63209 ] Published: Sep 29, 2026, 2:58:53 PM UTC
compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a d
High(7.5) Affected Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-4.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Affected · Fixed: 4.3.0-4.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-4.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-4.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-81871 ] Published: Sep 16, 2026, 8:43:40 PM UTC
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIF
Medium(6.5) Affected Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Affected · Fixed: 4.3.0-3.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-85732 ] Published: Sep 16, 2026, 4:22:14 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without v
Medium(4.7) Affected Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Affected · Fixed: 4.3.0-2.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-56855 ] Published: Sep 2, 2026, 7:12:04 PM UTC
golang-go.crypto: CVE-2026-56855
High(7.5) Affected Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-1.1
Version impact unknown
dsa · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Affected · Fixed: 4.3.0-1.1
dsa · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-1.1
Version impact unknown
dsa · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.3.0-1.1
Version impact unknown
dsa · helm · opensuse · tumbleweed
[CVE-2026-37236 ] Published: Aug 28, 2026, 12:00:00 AM UTC
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST reque
Critical(9.8) Affected Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Affected · Fixed: 4.2.4-3.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-63308 ] Published: Jul 17, 2026, 4:14:15 PM UTC
helm-4.2.3-4.1 on GA media
Medium(4.3) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-4.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.3-4.1
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-4.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-4.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
[CVE-2026-56852 ] Published: Jul 14, 2026, 5:29:56 PM UTC
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
High(7.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.3-3.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-3.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-48978 ] Published: Jul 1, 2026, 9:35:45 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowi
Low(3.1) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.2-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.2-2.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.2-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.2-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-50151 ] Published: Jul 1, 2026, 9:35:45 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolit
High(7.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.3-2.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.3-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-50163 ] Published: Jul 1, 2026, 9:35:45 PM UTC
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved
High(7.1) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.4-1.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-41178 ] Published: Jun 4, 2026, 2:38:23 PM UTC
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log e
High(7.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.4-1.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-41888 ] Published: May 14, 2026, 4:53:37 PM UTC
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: fals
Medium(6.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.0-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.0-1.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.0-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.0-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-33814 ] Published: May 7, 2026, 7:21:40 PM UTC
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
High(7.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.0-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.2.0-2.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.0-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.2.0-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-35205 ] Published: Apr 9, 2026, 3:06:41 PM UTC
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed
High(8.4) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.4-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.1.4-2.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.4-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.4-2.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2026-35204 ] Published: Apr 9, 2026, 3:03:28 PM UTC
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrar
High(8.4) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.1.4-1.1
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.4-1.1
Version impact unknown
nvd · helm · opensuse · tumbleweed
[CVE-2025-55199 ] Published: Aug 13, 2025, 11:23:43 PM UTC
govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media
Medium(6.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.1-3.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 4.1.1-3.1
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.1-3.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 4.1.1-3.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
[CVE-2025-53547 ] Published: Jul 8, 2025, 9:39:59 PM UTC
k9s-0.50.7-2.1 on GA media
High(8.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.18.4-1.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.18.4-1.1
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.18.4-1.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.18.4-1.1
Version impact unknown
pypi · helm · opensuse · tumbleweed
[CVE-2025-22872 ] Published: Apr 16, 2025, 5:13:02 PM UTC
Go Networking vulnerabilities
Medium(6.5) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.18.3-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.18.3-1.1
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.18.3-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.18.3-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
[CVE-2025-22870 ] Published: Mar 4, 2025, 11:00:00 PM UTC
Go vulnerabilities
Medium(4.4) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.17.2-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.17.2-1.1
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.17.2-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.17.2-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
[CVE-2025-47911 ] Published: Jan 1, 2025, 12:00:00 AM UTC
Go Networking vulnerabilities
Medium(5.3) Unknown Details (4) 4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.19.1-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · x86_64 · tumbleweed
Fixed · Fixed: 3.19.1-1.1
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.19.1-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
4.2.4-1.1 · noarch · tumbleweed
Unknown · Fixed: 3.19.1-1.1
Version impact unknown
usn · helm · opensuse · tumbleweed
