GO-2025-4123 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, sqlexporter, jitsucom-bulker, grafana-alloy, cluster-api-aws-controller, amazon-cloudwatch-agent, argo-events, splunk-otel-collector, bento...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kargo, opentelemetry-collector-contrib, k8sgpt, kubeflow-pipelines, argo-rollouts, opentelemetry-collector, grafana-alloy, amazon-cloudwatch-agent, splunk-otel-collector, argo-workflows, nats...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: temporal-server, trillian, caddy, kots, amass, ferretdb, k3s, spicedb, step, kine, step-ca, argo-workflows, kube-bench, src...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flyte, restic, chezmoi, sqlpad, sops, terragrunt, goreleaser, timestamp-authority, airflow, fulcio, policy-controller, opentelemetry-collector-contrib, wal-g, buildkitd, k8sgpt, druid, kubescape, prometheus-operator, secrets-store-csi-driver-provider-azure, tkn,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: temporal-server, nri-consul, chisel, pgpool2exporter, runc, terraform-provider-acme, conftest, temporal, emissary, omnibump, containerd, rancher-webhook, prometheus-adapter, crossplane-provider-aws-lambda, terraform-provider-grafana, azure-workload-identity-webhook,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: slsa-verifier, kots, cloudflared, sops, terragrunt, fulcio, kubescape, tkn, flux-source-controller, argo-workflows, gitsign, oauth2-proxy, spire-server, dex, aactl, cosign, tekton-chains, rekor, flux-kustomize-controller, vexctl...

GO-2026-4976 vulnerabilities

Vulnerabilities for packages: grafana, telegraf, aws-flb-firehose, kots, kubernetes-dashboard, runc, k8s-device-plugin, argo-cd, containerd, redka, nerdctl, coredns, juicefs, kubevela, prometheus-operator, istio, karma, dask-gateway, mattermost, go, zot, aws-flb-cloudwatch, falco-no-driver, flux,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: chisel, loki, nfpm, terraform-provider-acme, kine, containerd, crossplane-provider-aws-lambda, wal-g, caddy, crossplane-provider-family-azure, crossplane-provider-aws-ec2, kubescape, crossplane-provider-aws-memorydb, terraform-provider-tls, istio, kargo, zot, flux,...

GO-2026-4971 vulnerabilities

Vulnerabilities for packages: temporal-server, runc, grafana-pyroscope, nfpm, terraform-provider-acme, conftest, timestamp-authority, helm-operator, containerd, prometheus-adapter, cert-manager-csi-driver, nri-prometheus, controller-gen, nri-apache, tempo, terraform-provider-tls, istio, karma,...

GO-2026-4982 vulnerabilities

Vulnerabilities for packages: temporal-server, runc, grafana-pyroscope, terraform-provider-acme, conftest, helm-operator, containerd, prometheus-adapter, cert-manager-csi-driver, tempo, terraform-provider-tls, istio, karma, crossplane, lazydocker, cloud-sql-proxy, zot, flux, sftpgo, gatekeeper,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-consul, conftest, emissary, nri-redis, helm-operator, containerd, helm-set-status, wait-for-port, wal-g, ini-file, caddy, controller-gen, nri-apache, kubernetes-dashboard-api, docker-machine-driver-harvester, harbor-cli, lazydocker, cloud-sql-proxy,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: slsa-verifier, src-fingerprint, crossplane-provider-azure-storage, rabbitmq-messaging-topology-operator, sops, terragrunt, goreleaser, timestamp-authority, crossplane-provider-azure-managedidentity, flux-notification-controller, crossplane-provider-azure-authorizatio...

GHSA-48P8-G2FX-3WWM Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-EU00318 Security fixes in argo-workflows 3.7.17-r1

Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...

CLEANSTART-2026-ES11075 Security fixes in argo-events 1.9.10-r1

Package argo-events version 1.9.10-r1 fixes 17 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-33186, ghsa-mh2q-q3fh-2475, CVE-2026-29181...

CLEANSTART-2026-GP43617 Security fixes in argo-workflows 3.7.17-r2

Package argo-workflows version 3.7.17-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-VQ05668 Security fixes in argo-cd-fips 3.4.4-r2

Package argo-cd-fips version 3.4.4-r2 fixes 1 vulnerabilities: CVE-2026-39822...

CLEANSTART-2026-KJ21484 Security fixes in argo-events 1.6.3-r1

Package argo-events version 1.6.3-r1 fixes 9 vulnerabilities: CVE-2022-1996, ghsa-r48q-9g5r-8q2h, ghsa-p77j-4mvh-x3m3, ghsa-m425-mq94-257g, CVE-2026-33186...