Critical GitHub Attack

This is serious: A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, argo-cd-fips, nats, argo-rollouts-fips, opentelemetry-collector-contrib-fips, grafana-alloy-fips, tempo, amazon-cloudwatch-agent-fips, argo-workflows, amazon-cloudwatch-agent, kargo, keda, kubeflow-pipelines, opentelemetry-collector,...

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

Cybersecurity researchers are calling attention to an incident in which the popular GitHub Action tj-actions/changed-files was compromised to leak secrets from repositories using the continuous integration and continuous delivery CI/CD workflow. The incident involved the tj-actions/changed-files...

CVE-2025-27616

Vela Server (CI/CD framework) is affected in versions prior to 0.25.3 and 0.26.3. By spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo-level CI secrets to another repository. Those secrets could be exfiltrate...

Linux Distros Unpatched Vulnerability : CVE-2021-3602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.15.1 security update

An update is now available for Red Hat OpenShift GitOps v1.15.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, metrics-server, kine, kubernetes-dns-node-cache, kyverno-policy-reporter-kyverno-plugin, nats-server, nri-haproxy, gcsfuse, esbuild, temporal-ui-server, sonobuoy, cni-plugins, aws-flb-cloudwatch, kubernetes-csi-external-resizer, mage, mongo-tool...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: terragrunt, dagdotdev, kots, traefik, oauth2-proxy, sigstore-scaffolding, temporal-ui-server, step-issuer, grpc-health-probe, kargo, dgraph, openbao, rook, weaviate, rabbitmq-messaging-topology-operator, tflint, argo-workflows, grafana-alloy, wolfictl, zarf, flyte,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: k3d, spire-controller-manager, traefik, harbor, weaviate, harbor-registry, kyverno-policy-reporter, istio-pilot-discovery, temporal-fips, distribution, harbor-registry-fips, cilium, step-issuer-fips, argo-workflows, fulcio, skopeo, kyverno-notation-aws-fips, apko,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: terragrunt, dagdotdev, kots, traefik, oauth2-proxy, sigstore-scaffolding, temporal-ui-server, step-issuer, grpc-health-probe, kargo, dgraph, openbao, rook, weaviate, rabbitmq-messaging-topology-operator, tflint, argo-workflows, grafana-alloy, wolfictl, zarf, flyte,...

GHSA-JGFP-53C3-624W vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, kubernetes, rancher-fleet, argo-cd-fips, argo-rollouts-fips, argocd-image-updater, kubernetes-csi-driver-nfs-fips, yunikorn-k8shim, emissary, local-static-provisioner-fips, node-feature-discovery, calico-fips, nodetaint, cluster-autoscaler-fips,...

CVE-2025-0426 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, kubernetes, rancher-fleet, argo-cd-fips, argo-rollouts-fips, argocd-image-updater, kubernetes-csi-driver-nfs-fips, yunikorn-k8shim, emissary, local-static-provisioner-fips, node-feature-discovery, calico-fips, nodetaint, cluster-autoscaler-fips,...

SUSE CVE-2025-23216

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

CVE-2022-24768

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5...

CVE-2023-6386

A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation...

CVE-2023-6386

Removed by vendor...

GO-2025-3433 Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd

Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd...

GO-2025-3437 Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine

Argo CD GitOps Engine does not scrub secret values from patch errors in github.com/argoproj/gitops-engine. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Sensitive Information Disclosure

github.com/argoproj/argo-cd is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of invalid Kubernetes Secret resources, allowing secret values to be exposed in error messages and the diff view. An attacker with write access to the repository can commit...

Secret Exposure

github.com/argoproj/gitops-engine is vulnerable to Secret Exposure. The vulnerability is due to improper handling of invalid Kubernetes Secret resources, which exposes secret values in error messages and the diff view during synchronization, allows an attacker with write access to the repository ...