Linux Distros Unpatched Vulnerability : CVE-2026-16301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-14814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions,...

Linux Distros Unpatched Vulnerability : CVE-2026-97229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

BIT-ARGO-CD-2026-55797 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are...

PT-2026-115871

GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without...

PT-2026-115866

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's...

PT-2026-115844

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are...

PT-2026-115859

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

PT-2026-115861

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without...

PT-2026-115874

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular...

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks...

EUVD-2026-98917

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks...

GHSA-FMXQ-CGP8-87WP Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks...

CLEANSTART-2026-ZD82952 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-ZG54261 Security fix for GHSA-gxhx-2686-5h9g applied in: argo-cd 3.4.10-r2

Security vulnerability affects the argo-cd package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GE22690 Security fix for GHSA-w5pp-99ch-qj29 applied in: argo-cd 3.4.10-r2

Security vulnerability affects the argo-cd package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TV37644 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-MD00840 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-LM14651 go-git is an extensible git implementation library written in pure Go

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

CLEANSTART-2026-AR15504 go-git is a highly extensible git implementation library written in pure Go

Security vulnerability affects the argo-cd package. go-git is a highly extensible git implementation library written in pure Go...