ArgoCD Project API Token Repository Credentials Exposure

Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials usernames, passwords through the project details API endpoint, even when the token only has standard application management permissions and no explicit access to secrets. This vulnerability...

SUSE CVE-2026-45738

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...

CLEANSTART-2026-FE71237 Security fixes in argo-cd 3.4.4-r2

Package argo-cd version 3.4.4-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-AD01239 Security fixes in argo-cd-fips 3.2.5-r0

Package argo-cd-fips version 3.2.5-r0 fixes 7 vulnerabilities: CVE-2026-1229, CVE-2026-25934, CVE-2026-24051, CVE-2026-33186, CVE-2026-25679...

CLEANSTART-2026-PX91714 Security fixes in argo-cd 3.2.7-r4

Package argo-cd version 3.2.7-r4 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-ZP98003 Security fixes in argo-cd-fips 3.0.20-r2

Package argo-cd-fips version 3.0.20-r2 fixes 11 vulnerabilities: ghsa-93mq-9ffx-83m2, ghsa-6v2p-p543-phr9, ghsa-pwhc-rpq9-4c8w, ghsa-j5w8-q4qc-rx2x, ghsa-c6gw-w398-hv78...

CLEANSTART-2026-JV08197 Security fixes in argo-cd-fips 3.0.21-r1

Package argo-cd-fips version 3.0.21-r1 fixes 2 vulnerabilities: CVE-2026-24051, CVE-2026-1229...

CLEANSTART-2026-TB66976 Security fixes in argo-cd 3.0.23-r2

Package argo-cd version 3.0.23-r2 fixes 13 vulnerabilities: CVE-2026-34165, ghsa-3xc5-wrhm-f963, CVE-2026-34165, CVE-2026-32288, CVE-2026-32289...

CLEANSTART-2026-EC80083 Security fixes in argo-cd-fips 3.3.1-r1

Package argo-cd-fips version 3.3.1-r1 fixes 1 vulnerabilities: CVE-2026-24051...

CLEANSTART-2026-JB59425 Security fixes in argo-cd 3.4.3-r0

Package argo-cd version 3.4.3-r0 fixes 4 vulnerabilities: CVE-2026-48978, ghsa-vh4v-2xq2-g5cg, CVE-2026-50162, CVE-2026-50151...

CLEANSTART-2026-ZL46778 Security fixes in argo-cd 3.1.16-r3

Package argo-cd version 3.1.16-r3 fixes 2 vulnerabilities: CVE-2026-42505, CVE-2026-39822...

CLEANSTART-2026-IX36861 Security fixes in argo-cd 3.2.12-r1

Package argo-cd version 3.2.12-r1 fixes 4 vulnerabilities: CVE-2026-48978, CVE-2026-50162, CVE-2026-50151, ghsa-vh4v-2xq2-g5cg...

CLEANSTART-2026-FP97062 Security fixes in argo-cd 3.3.5-r0

Package argo-cd version 3.3.5-r0 fixes 31 vulnerabilities: CVE-2026-42880, CVE-2026-45738, CVE-2026-45737, ghsa-3v3m-wc6v-x4x3, ghsa-h98r-wv3h-fr38...

EUVD-2026-50482

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436

GitLab CE/EE is affected by CVE-2026-12436 in versions 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. The issue arises from improper validation of user-supplied attributes when processing pipeline schedule inputs, potentially allowing an authenticated user to modify another user’...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

GHSA-XG2H-5XR2-29JW Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...

OESA-2026-3132 GraphicsMagick security update

GraphicsMagick is a comprehensive image processing package which is initially based on ImageMagick 5.5.2, but which has undergone significant re-work by the GraphicsMagick Group to significantly improve the quality and performance of the software. Security Fixes: A flaw was found in...

CLEANSTART-2026-EH36582 Security fixes for CVE-2025-47912, CVE-2025-55190, CVE-2025-55191, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-59537, CVE-2025-59538, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-29181, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-35469, CVE-2026-39821, CVE-2026-39883, CVE-2026-41506, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42880, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, CVE-2026-45737, CVE-2026-45738, ghsa-2v5j-vhc3-9cwm, ghsa-2vgg-9h3w-qbr4, ghsa-2xsj-vh29-9cwm, ghsa-37cx-329c-33x3, ghsa-389r-gv7p-r3rp, ghsa-3v3m-wc6v-x4x3, ghsa-3wgm-2mw2-vh5m, ghsa-3xc5-wrhm-f963, ghsa-4x4m-3c2p-qppc, ghsa-6v2p-p543-phr9, ghsa-78h2-9frx-2jm8, ghsa-92cp-5422-2m47, ghsa-93mq-9ffx-83m2, ghsa-crhj-59gh-8x96, ghsa-f6x5-jh6r-wrfv, ghsa-gm2x-2g9h-ccm8, ghsa-gxhx-2686-5h9g, ghsa-h98r-wv3h-fr38, ghsa-hfvc-g4fc-pqhx, ghsa-hj2p-8wj8-pfq4, ghsa-j5w8-q4qc-rx2x, ghsa-jhf3-xxhw-2wpp, ghsa-m3xc-h892-ggx6, ghsa-m7cr-m3pv-hgrp, ghsa-mh2q-q3fh-2475, ghsa-mh63-6h87-95cp, ghsa-mw99-9chc-xw7r, ghsa-pc3f-x583-g7j2, ghsa-qw64-3x98-g7q2, ghsa-rg3g-4rw9-gqrp applied in versions: 2.13.9-r0, 2.14.20-r0, 3.0.16-r0, 3.0.19-r0, 3.1.4-r0, 3.1.8.-r0, 3.1.9-r4, 3.2.7-r0, 3.2.7-r1, 3.2.7-r2, 3.2.7-r3, 3.2.7-r4

Multiple security vulnerabilities affect the argo-cd package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QT53274 Security fixes for CVE-2025-47912, CVE-2025-55190, CVE-2025-55191, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-59537, CVE-2025-59538, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-27145, CVE-2026-29181, CVE-2026-33186, CVE-2026-33762, CVE-2026-34165, CVE-2026-34986, CVE-2026-35469, CVE-2026-39821, CVE-2026-39883, CVE-2026-41506, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, CVE-2026-42880, CVE-2026-44740, CVE-2026-44973, CVE-2026-45022, CVE-2026-45570, CVE-2026-45571, CVE-2026-45737, CVE-2026-45738, ghsa-2v5j-vhc3-9cwm, ghsa-2vgg-9h3w-qbr4, ghsa-2xsj-vh29-9cwm, ghsa-37cx-329c-33x3, ghsa-389r-gv7p-r3rp, ghsa-3v3m-wc6v-x4x3, ghsa-3wgm-2mw2-vh5m, ghsa-3xc5-wrhm-f963, ghsa-4x4m-3c2p-qppc, ghsa-6v2p-p543-phr9, ghsa-78h2-9frx-2jm8, ghsa-92cp-5422-2m47, ghsa-93mq-9ffx-83m2, ghsa-cp6g-7hqx-qxhp, ghsa-crhj-59gh-8x96, ghsa-f6x5-jh6r-wrfv, ghsa-gm2x-2g9h-ccm8, ghsa-gxhx-2686-5h9g, ghsa-h98r-wv3h-fr38, ghsa-hfvc-g4fc-pqhx, ghsa-hj2p-8wj8-pfq4, ghsa-j5w8-q4qc-rx2x, ghsa-jhf3-xxhw-2wpp, ghsa-m3xc-h892-ggx6, ghsa-m7cr-m3pv-hgrp, ghsa-mh2q-q3fh-2475, ghsa-mh63-6h87-95cp, ghsa-mw99-9chc-xw7r, ghsa-pc3f-x583-g7j2, ghsa-qw64-3x98-g7q2, ghsa-rg3g-4rw9-gqrp applied in versions: 2.13.9-r0, 2.14.20-r0, 3.0.16-r0, 3.0.19-r0, 3.1.4-r0, 3.1.8.-r0, 3.1.9-r4, 3.2.7-r0, 3.2.7-r1, 3.2.7-r2, 3.2.7-r3, 3.2.7-r4, 3.3.12-r0

Multiple security vulnerabilities affect the argo-cd package. These issues are resolved in later releases. See references for individual vulnerability details...