GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, py3-captum, kubeflow-katib, sqlpad, nextcloud-server, tensorflow-gpu-jupyter, langfuse, dbgate, arangodb, actions-runner, kibana, azurite, drupal, py3-jupyterlab, renovate, opensearch-dashboards-fips, jupyter-base-notebook, prism,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: vault, spire-server, rke2-runtime, pgtimetable, step, gitlab-cng-fips, flyte, dapr, gotrue-fips, seaweedfs, spqr, gotrue, kube-bench-fips, certificate-transparency, harbor, dapr-fips, authentik-fips, grafana-alloy-fips, step-issuer, juicefs, spicedb-fips, teleport,...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

The CVE describes an unchecked array index in Argo Workflows’ pod informer, specifically in podGCFromPod(), which can cause a controller-wide panic when a workflow pod has a malformed workflows.argoproj.io/pod-gc-strategy annotation. Affected versions span 3.6.5 through 4.0.4, with the panic occu...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

PT-2026-34719

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.5 through 3.6.19 Argo Workflows versions 3.7.0-rc1 through 3.7.12 Argo Workflows versions 4.0.0-rc1 through 4.0.4 Description An unchecked array index in the pod informer's podGCFromPod function causes a...

CVE-2026-40886: Improper Validation of Array Index

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

Argo Workflows 输入验证错误漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 3.6.5 to 4.0.4 of Argo Workflows contain a vulnerability related to input validation errors. This vulnerability stems from insufficient array index checking in the podGCFromPod...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, opensearch-dashboards, thingsboard, code-server, prism, kubeflow-pipelines, lerna, configurable-http-proxy, langfuse, argo-workflows, nextcloud-server, saf...

GHSA-F23M-R3PF-42RH vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, py3-captum, kubeflow-katib, sqlpad, json-server, tensorflow-gpu-jupyter, langfuse, arangodb, kibana, drupal, py3-jupyterlab, renovate, opensearch-dashboards-fips, jupyter-base-notebook, prism, librechat, gitlab-rails-ce-fips, vitess,...

GHSA-R5FR-RJXR-66JC vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, py3-captum, kubeflow-katib, sqlpad, json-server, langfuse, arangodb, kibana, drupal, py3-jupyterlab, renovate, opensearch-dashboards-fips, jupyter-base-notebook, prism, librechat, gitlab-rails-ce-fips, vitess, ts-patch, code-server,...

CVE-2026-4800 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, py3-captum, kubeflow-katib, sqlpad, json-server, langfuse, arangodb, kibana, drupal, py3-jupyterlab, renovate, opensearch-dashboards-fips, jupyter-base-notebook, prism, librechat, gitlab-rails-ce-fips, vitess, ts-patch, code-server,...

CVE-2026-2950 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, py3-captum, kubeflow-katib, sqlpad, json-server, tensorflow-gpu-jupyter, langfuse, arangodb, kibana, drupal, py3-jupyterlab, renovate, opensearch-dashboards-fips, jupyter-base-notebook, prism, librechat, gitlab-rails-ce-fips, vitess,...

CVE-2026-2950 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-katib, opensearch-dashboards, vitess, json-server, jitsucom-jitsu, kubeflow-centraldashboard, code-server, prism, kubeflow-pipelines, langfuse, argo-workflows, py3-jupyterlab, npm, renovate, sqlpad, ts-patch, saf...

GHSA-F23M-R3PF-42RH vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-katib, opensearch-dashboards, vitess, json-server, jitsucom-jitsu, kubeflow-centraldashboard, code-server, prism, kubeflow-pipelines, langfuse, argo-workflows, py3-jupyterlab, npm, renovate, sqlpad, ts-patch, saf...

GHSA-R5FR-RJXR-66JC vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-katib, opensearch-dashboards, vitess, json-server, jitsucom-jitsu, kubeflow-centraldashboard, code-server, prism, kubeflow-pipelines, langfuse, argo-workflows, py3-jupyterlab, npm, renovate, sqlpad, ts-patch, saf...

CVE-2026-4800 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, kubeflow-katib, opensearch-dashboards, vitess, json-server, jitsucom-jitsu, kubeflow-centraldashboard, code-server, prism, kubeflow-pipelines, langfuse, argo-workflows, py3-jupyterlab, npm, renovate, sqlpad, ts-patch, saf...

CLEANSTART-2026-MK40719 Security fixes for CVE-2025-0913, CVE-2025-4673, CVE-2025-47907, CVE-2025-58181, CVE-2025-62156, CVE-2025-62157, CVE-2026-24051, CVE-2026-25934, CVE-2026-27141, ghsa-2x5j-vhc8-9cwm, ghsa-37cx-329c-33x3, ghsa-c2hv-4pfj-mm2r, ghsa-cfpf-hrx2-8rv6, ghsa-p84v-gxvw-73pf applied in versions: 3.6.13-r0, 3.6.15-r1, 3.6.18 r0, 3.6.18-r0, 3.7.0-r0, 3.7.3-r0

Multiple security vulnerabilities affect the argo-workflows-fips package. These issues are resolved in later releases. See references for individual vulnerability details...