GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: act, flux-image-automation-controller, grafana-alloy, kargo, rancher-fleet, wolfictl, witness, apko, gitsign, grype, trivy-operator, flux-source-controller, gitlab-runner, nuclei, kots, kyverno, gptscript, guac, kubescape, crossplane, skaffold, dagger, kubevela, zarf...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: argo-events, flux-image-automation-controller, pulumi-language-yaml, gitlab-rails-ce-fips, scorecard, gitaly, kubevela, syft, flux-source-controller, argo-workflows, packer, argo-cd, chainctl, pulumi-language-java, teleport, rancher-fleet, kots, cloudbeat,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: argo-events, flux-image-automation-controller, pulumi-language-yaml, gitlab-rails-ce-fips, scorecard, gitaly, kubevela, syft, flux-source-controller, argo-workflows, packer, argo-cd, chainctl, pulumi-language-java, teleport, rancher-fleet, kots, cloudbeat,...

PT-2026-40270

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

PT-2026-40272

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

PT-2026-40269

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

PT-2026-40273

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/sync cm.go performs zero authorization checks on all CRUD operations create, read,...

PT-2026-40271

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

GHSA-FV7C-FP4J-7GWP vulnerabilities

Vulnerabilities for packages: argo-workflows, vitess, kubeflow-katib...

CVE-2026-44728 vulnerabilities

Vulnerabilities for packages: argo-workflows, vitess, kubeflow-katib...

GHSA-V39H-62P7-JPJC vulnerabilities

Vulnerabilities for packages: drupal, kibana, gitlab-rails-ce-fips, keep, langfuse, opensearch-dashboards-fips, argo-workflows, arangodb, tileserver-gl, opensearch-dashboards, wazuh-dashboard-fips, prism, vitess, langfuse-fips, tileserver-gl-fips, gitlab-rails-ce, saf, wazuh-dashboard, keep-fips,...

GHSA-FV7C-FP4J-7GWP vulnerabilities

Vulnerabilities for packages: py3-captum, vitess, kubeflow-katib, gitlab-rails-ce, argo-workflows, arangodb, gitlab-rails-ce-fips, emscripten...

CVE-2026-6322 vulnerabilities

Vulnerabilities for packages: drupal, kibana, gitlab-rails-ce-fips, keep, langfuse, opensearch-dashboards-fips, argo-workflows, arangodb, tileserver-gl, opensearch-dashboards, wazuh-dashboard-fips, prism, vitess, langfuse-fips, tileserver-gl-fips, gitlab-rails-ce, saf, wazuh-dashboard, keep-fips,...

CVE-2026-44728 vulnerabilities

Vulnerabilities for packages: py3-captum, vitess, kubeflow-katib, gitlab-rails-ce, argo-workflows, arangodb, gitlab-rails-ce-fips, emscripten...

CVE-2026-42295

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

CVE-2026-42296

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

CVE-2026-42297

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read,...

CVE-2026-42294

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the...

CVE-2026-42183

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...

CVE-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...