Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

CVE-2026-42876 External Secrets Operator: Priviledge escalation with secret overwriting

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will automatically populat...

CVE-2026-42880

A flaw was found in Argo CD, a GitOps continuous delivery tool for Kubernetes. A missing authorization and data-masking gap in the ServerSideDiff endpoint allows an attacker with read-only access to extract sensitive Kubernetes Secret data. This information disclosure occurs by leveraging the...

BIT-ARGO-CD-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-6860 vulnerabilities

Vulnerabilities for packages: request-9047-keycloak-fips, spark-kubernetes-operator, apache-pulsar, apache-camel-karavan-devmode, spark-fips, wildfly, strimzi-kafka-operator-fips, keycloak-fips, apicurio-registry-fips, strimzi-kafka-operator, kafka-bridge, druid, spark, apicurio-registry,...

GHSA-3G76-F9XQ-8VP6 vulnerabilities

Vulnerabilities for packages: request-9047-keycloak-fips, spark-kubernetes-operator, apache-pulsar, apache-camel-karavan-devmode, spark-fips, wildfly, strimzi-kafka-operator-fips, keycloak-fips, apicurio-registry-fips, strimzi-kafka-operator, kafka-bridge, druid, spark, apicurio-registry,...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: karpenter, istio, cilium, redka, dask-gateway, nerdctl, zarf, kubernetes-csi-node-driver-registrar, minio, containerd, kubevela, karma, go, argo-cd, hubble, runc, kots, telegraf, cert-manager, coredns, aactl, kaf, cilium-cli, helm, grafana, juicefs, k8s-device-plugin...

GHSA-H74G-238J-357M vulnerabilities

Vulnerabilities for packages: kubevela-fips, nvidia-nsight-compute-13.2, trino, longhorn-backing-image-manager, libnvidia-container-fips, cluster-autoscaler-fips, kubernetes-csi-node-driver-registrar-fips, authentik, gatekeeper-fips, kyverno, cert-manager-fips, grafana, loki, minio,...

GHSA-XQ5J-9R39-C3VF vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, gotrue, argocd-image-updater-fips, rabbitmq-messaging-topology-operator-fips, cluster-autoscaler-fips, helmfile, crossplane-provider-aws-appflow, authentik,...

CVE-2026-42297

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

EUVD-2026-28894

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

CVE-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

CVE-2026-42295 Argo Workflows: Exposure of artifact repository credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

EUVD-2026-28895

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42297

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42297 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...