https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:52:25.837792+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07345 bdu:2026-07345 2026-10-02T23:52:25.844514+00:00 bdu:2026-07345 https://cve.radiocsirt.org/vuln/bit-helm-2026-35205 BIT-helm-2026-35205 — Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install 2026-10-02T23:52:25.844546+00:00

Affected: Bitnami: helm

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-ks65231 CLEANSTART-2026-KS65231 — Security fix for CVE-2026-35205 applied in: kumactl 2.13.4-r0 2026-10-02T23:52:25.844577+00:00

Affected: CleanStart: kumactl

Security vulnerability affects the kumactl package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-337293 EUVD-2026-337293 2026-10-02T23:52:25.844597+00:00 EUVD-2026-337293 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35205 fkie_cve-2026-35205 2026-10-02T23:52:25.844609+00:00

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

 https://cve.radiocsirt.org/vuln/ghsa-q5jf-9vfq-h4h7 GHSA-q5jf-9vfq-h4h7 — Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install 2026-10-02T23:52:25.844628+00:00

Affected: Go: helm.sh/helm/v4

Helm is a package manager for Charts for Kubernetes. In Helm versions >=4.0.0 and <=4.1.3, Helm will install plugins missing provenance (`.prov` file) when signature verification is required.

### Impact

The bug allows plugin authors to omit provenance (signing) data from plugins, bypassing plugin signature verification upon plugin install/update.

Notably, plugin hooks will be executed as designed on the installed plugin, enabling a malicious plugin to execute arbitrary code.

### Patches

This issue has been patched in Helm v4.1.4

Installing/updating a plugin with missing provenance will error if signature verification is required.

### Workarounds

Users may manually validate that a plugin archive is not missing provenance data (`.prov` file) before installation.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10538-1 openSUSE-SU-2026:10538-1 — helm-4.1.4-2.1 on GA media 2026-10-02T23:52:25.844656+00:00

helm-4.1.4-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:26441 RHSA-2026:26441 — Red Hat Security Advisory: Helm CLI v4.1.4 release 2026-10-02T23:52:25.844673+00:00

github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1048 WID-SEC-W-2026-1048 — helm: Mehrere Schwachstellen 2026-10-02T23:52:25.844690+00:00

Ein Angreifer kann mehrere Schwachstellen in helm ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, und potenziell um beliebigen Code auszuführen.