CLEANSTART-2026-AQ85366 Security fixes in argo-workflows-fips 3.7.9-r2

Package argo-workflows-fips version 3.7.9-r2 fixes 3 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958, CVE-2026-24051...

CLEANSTART-2026-QJ99609 Security fixes in argo-workflows 3.7.10-r3

Package argo-workflows version 3.7.10-r3 fixes 2 vulnerabilities: ghsa-fw7p-63qq-7hpr, CVE-2026-26958...

CLEANSTART-2026-YD39536 Security fixes in argo-workflows 3.6.17-r0

Package argo-workflows version 3.6.17-r0 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2026-25934, CVE-2026-25934...

CVE-2026-15054

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

CVE-2026-15054 Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

PT-2026-65895

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description HTTP-emitting modules fetch caller-controlled URLs without using the validate url with env config function, which allows Server-Side Request Forgery SSRF to internal or metadata endpoints. SSRF ...

BIT-ARGO-WORKFLOWS-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

CVE-2026-16799

Affected product: Devolutions PowerShell Universal (versions 2026.2.2 and earlier). Vulnerability: improper access control in automation tests and workflows features, enabling an authenticated user with only the Reader role to execute automation tests and modify workflow properties due to missing...

EUVD-2026-48606

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

PT-2026-64308

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper access control within the automation tests and workflows features allows an authenticated user assigned the Reader role to execute automation tests and modify...

GHSA-V2HH-GCRM-F6HX vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, librechat, argo-workflows, arangodb, langfuse, gemini-cli, unleash, vitess, keep, wazuh-dashboard-fips, renovate, opensearch-dashboards, yaml-language-server, opensearch-dashboards-fips, tileserver-gl, wazuh-dashboard, unleash-proxy, unleash-fips,...

CVE-2026-16221 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, librechat, argo-workflows, arangodb, langfuse, gemini-cli, unleash, vitess, keep, wazuh-dashboard-fips, renovate, opensearch-dashboards, yaml-language-server, opensearch-dashboards-fips, tileserver-gl, wazuh-dashboard, unleash-proxy, unleash-fips,...

GHSA-V2HH-GCRM-F6HX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, argo-workflows, vitess, yaml-language-server, tileserver-gl, langfuse, renovate...

CVE-2026-16221 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, argo-workflows, vitess, yaml-language-server, tileserver-gl, langfuse, renovate...

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...