2104 matches found
GHSA-GFHX-HW2G-V5HG vulnerabilities
Vulnerabilities for packages: argo-workflows...
CVE-2026-97711 vulnerabilities
Vulnerabilities for packages: argo-workflows...
GHSA-GFHX-HW2G-V5HG vulnerabilities
Vulnerabilities for packages: argo-workflows...
CVE-2026-97711 vulnerabilities
Vulnerabilities for packages: argo-workflows...
ArgoCD Project API Token Repository Credentials Exposure
Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...
CVE-2026-82277
A missing-authentication flaw CWE-306 was found in the Argo Rollouts dashboard. The dashboard binds to all network interfaces 0.0.0.0 and exposes mutating Rollout operations — including PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout — without any...
BIT-ARGO-WORKFLOWS-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...
CLEANSTART-2026-NW68824 Impact: In body-parser versions prior to 1
Security vulnerability affects the argo-workflows package. Impact: In body-parser versions prior to 1...
CLEANSTART-2026-ZQ97544 path-to-regexp turns path strings into a regular expressions
Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...
CLEANSTART-2026-WO79894 websocket-driver is a WebSocket protocol handler with pluggable I/O
Security vulnerability affects the argo-workflows package. websocket-driver is a WebSocket protocol handler with pluggable I/O...
CLEANSTART-2026-HE25090 Browserslist is a configuration tool for sharing target browsers and Node
Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...
CLEANSTART-2026-CI28358 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects...
CLEANSTART-2026-RQ08724 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects
Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects...
CLEANSTART-2026-RI71860 js-yaml is a JavaScript YAML parser and dumper
Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...
CLEANSTART-2026-FQ89941 form-data is a library for creating readable multipart/form-data streams
Security vulnerability affects the argo-workflows package. form-data is a library for creating readable multipart/form-data streams...
CLEANSTART-2026-UD61753 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the argo-workflows package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-ZC37242 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
Security vulnerability affects the argo-workflows package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...
CLEANSTART-2026-MO36230 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0
Security vulnerability affects the argo-workflows package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...