Kargo security vulnerabilities

Kargo is an open-source continuous delivery tool developed by Akuity. Versions of Kargo prior to 1.8.7, 1.7.7, and 1.6.3 contained security vulnerabilities. These vulnerabilities stemmed from defects in the authentication checks for the GetConfig and RefreshResource API endpoints, which could all...

CVE-2025-68156 vulnerabilities

Vulnerabilities for packages: k3s, kine, grafana-alloy, argo-cd, argo-rollouts, opentelemetry-collector, nats, verticadb-operator, kargo, coredns, kserve, vale, amazon-cloudwatch-agent, k8sgpt, k8sgateway, splunk-otel-collector, opentelemetry-collector-contrib, datadog-agent, aws-otel-collector,...

GHSA-CFPF-HRX2-8RV6 vulnerabilities

Vulnerabilities for packages: k3s, kine, grafana-alloy, argo-cd, argo-rollouts, opentelemetry-collector, nats, verticadb-operator, kargo, coredns, kserve, vale, amazon-cloudwatch-agent, k8sgpt, k8sgateway, splunk-otel-collector, opentelemetry-collector-contrib, datadog-agent, aws-otel-collector,...

GHSA-CFPF-HRX2-8RV6 vulnerabilities

Vulnerabilities for packages: aws-otel-collector-fips, nrdot-collector-k8s, rke2-runtime, datadog-agent, kine, verticadb-operator, k8sgpt, argo-rollouts-fips, k3s, vale, argo-rollouts, argo-workflows, verticadb-operator-fips, opentelemetry-collector-contrib, keda, eks-distro-fips, coredns-fips,...

CVE-2025-68156 vulnerabilities

Vulnerabilities for packages: aws-otel-collector-fips, nrdot-collector-k8s, rke2-runtime, datadog-agent, kine, verticadb-operator, k8sgpt, argo-rollouts-fips, k3s, vale, argo-rollouts, argo-workflows, verticadb-operator-fips, opentelemetry-collector-contrib, keda, eks-distro-fips, coredns-fips,...

EUVD-2025-11119

Malicious code in bioql PyPI...

WordPress Kargo Theme <= 1.1.13 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Kargo versions = 1.1.13...

WordPress Kargo Theme <= 1.1.13 is vulnerable to Local File Inclusion

Software Kargo Type Theme Vulnerable versions = 1.1.13 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 31c938be3ceb Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-53547 vulnerabilities

Vulnerabilities for packages: cerbos, pluto, istio, k9s, zarf, trivy, tw, zot, kargo, rancher-fleet, cilium-cli, k8sgpt, flux-source-controller, helm-operator, kots, flux-helm-controller, cert-manager-cmctl, chart-testing, linkerd2, k8ssandra-client, eksctl, envoy-gateway, helm-push, chartmuseum,...

GHSA-557J-XG8C-Q2MM vulnerabilities

Vulnerabilities for packages: cerbos, pluto, istio, k9s, zarf, trivy, tw, zot, kargo, rancher-fleet, cilium-cli, k8sgpt, flux-source-controller, helm-operator, kots, flux-helm-controller, cert-manager-cmctl, chart-testing, linkerd2, k8ssandra-client, eksctl, envoy-gateway, helm-push, chartmuseum,...

CVE-2025-26908

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...

CVE-2025-26908

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...

CVE-2025-26908

CVE-2025-26908 (Kargo Entegratör – WooCommerce Kargo Entegrasyon Eklentisi) authenticates as Shop Manager+ and suffers SQL Injection due to improper neutralization. Affected versions: up to 1.1.14. Red Hat entry confirms the vulnerability and notes a patch has been applied; Wordfence WordPress pl...

CVE-2025-26908 WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...

CVE-2025-26908 WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gurmehub Kargo Entegratör kargo-entegrator allows SQL Injection.This issue affects Kargo Entegratör: from n/a through = 1.1.14...

WordPress plugin Kargo Entegratör SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A SQL injection...

WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Kargo Entegratör versions = 1.1.14...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: dagger, k3s, zarf, trivy, xeol, buildkitd, zot, syft, kargo, rancher-fleet, kaniko, cilium-cli, opa, kubescape, opa-envoy, osv-scanner, k8sgpt, flux-source-controller, helm-operator, kots, kubevela, wolfictl, fuse-overlayfs-snapshotter, docker-compose, helm,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: distribution, step-ca, istio, sftpgo, grafana-mimir, frp, rook, undock, zot, vault-benchmark, falcoctl, sftpgo-plugin-kms, gomplate, weaviate, boring-registry, gitsign, harbor-registry, melange, openbao, octo-sts, step-issuer, podman, vexctl, dagger, terragrunt, k3s,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: distribution, step-ca, istio, sftpgo, grafana-mimir, frp, rook, undock, zot, vault-benchmark, falcoctl, sftpgo-plugin-kms, gomplate, weaviate, boring-registry, gitsign, harbor-registry, melange, openbao, octo-sts, step-issuer, podman, vexctl, dagger, terragrunt, k3s,...