ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

CVE-2026-118386

A flaw was found in Gitea. An authenticated user with read access can achieve arbitrary code execution and access sensitive repository credentials by submitting a pull request review that references an unverified commit containing malicious workflow definitions. Because the commit is not validate...

CVE-2026-121588

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

CVE-2026-121588

The TeXlyre application (versions 0.11.0 before 0.13.5 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists when the application processes LSP or typesetter recipe icons . An attacker can provide a malicious icon containing an HTML event handler , which executes s...

CVE-2026-121588: texlyre: TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute…

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

PT-2026-132415

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location. Hel...

CVE-2026-113709

A flaw was found in Argo CD, where a Kustomize kustomization can point Helm at a repository-controlled directory and load a plugin that runs when Kustomize Helm rendering is enabled in the repo-server. This allows an attacker to execute arbitrary commands inside argocd-repo-server and read...

CVE-2026-113709

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113709

In Argo CD versions 2.1.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, a vulnerability exists when the --enable-helm flag is used for kustomize build . If helmGlobals.configHome points to a repository-controlled location, Helm automatically loads and executes downloader plugins from a directory ...

CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

Argo Project Argo CD Command Injection Vulnerability

The Argo CD versions from 2.7.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 have a command injection vulnerability. This vulnerability arises due to Kustomize failing to use an option end separator when passing query values for ref or version from remote...

Argo Project Argo CD Software Supply Chain Vulnerabilities

The Argo Project’s Argo CD versions from 2.1.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 contain software supply chain vulnerability issues. This vulnerability arises when --enable-helm is enabled for kustomize builds, allowing helmGlobals.configHome to point ...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248

The Amazon SageMaker Python SDK contains a vulnerability in the git_utils[.]py component affecting versions V3 before 3.10.0 and V2 before 2.257.3 . The runclone_command() function fails to redact credentials from subprocess error output during a failed git clone operation. This allows an authent...

EUVD-2026-101604

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

PT-2026-114022

Insertion of sensitive information into log files in the git utils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because...