CVE-2026-42350 Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2...

kargo 输入验证错误漏洞

Kargo is an open-source continuous delivery tool developed by Akuity. Versions of Kargo prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2 contained a vulnerability related to input validation errors. This vulnerability stemmed from the open redirection present in the UI OIDC login process via the...

PT-2026-39215

Name of the Vulnerable Software and Affected Versions Kargo versions prior to 1.7.10 Kargo versions prior to 1.8.13 Kargo versions prior to 1.9.8 Kargo versions prior to 1.10.2 Description Kargo, which manages and automates the promotion of software artifacts, contains an open redirect in the UI...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, nfpm, cerbos-fips, chainctl-fips, scorecard, trufflehog, kyverno, grafana-fips, xeol, external-secrets-operator, argo-cd-fips, commercial-chainloop-cli, packer, amazon-ssm-agent-fips, argo-events-fips, gitaly-fips, gitlab-runner, gitsign,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, nfpm, cerbos-fips, chainctl-fips, scorecard, trufflehog, kyverno, grafana-fips, xeol, external-secrets-operator, argo-cd-fips, commercial-chainloop-cli, packer, amazon-ssm-agent-fips, argo-events-fips, gitaly-fips, gitlab-runner, gitsign,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, nfpm, cerbos-fips, chainctl-fips, scorecard, trufflehog, kyverno, grafana-fips, xeol, external-secrets-operator, argo-cd-fips, commercial-chainloop-cli, packer, amazon-ssm-agent-fips, argo-events-fips, gitaly-fips, gitlab-runner, gitsign,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: melange, gitaly, nfpm, flux-source-controller, apko, dagger, argo-workflows, steampipe, guac, rancher-fleet, snyk-cli, xeol, bom, trivy-operator, flux, osv-scanner, kots, tfsec, src-fingerprint, flux-image-automation-controller, kubescape, trufflehog, kubevela, kanik...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: melange, gitaly, nfpm, flux-source-controller, apko, dagger, argo-workflows, steampipe, guac, rancher-fleet, snyk-cli, xeol, bom, trivy-operator, flux, osv-scanner, kots, tfsec, src-fingerprint, flux-image-automation-controller, kubescape, trufflehog, kubevela, kanik...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: melange, gitaly, nfpm, flux-source-controller, apko, dagger, argo-workflows, steampipe, guac, rancher-fleet, snyk-cli, xeol, bom, trivy-operator, flux, osv-scanner, kots, tfsec, src-fingerprint, flux-image-automation-controller, kubescape, trufflehog, kubevela, kanik...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: melange, gitaly, nfpm, flux-source-controller, apko, dagger, argo-workflows, steampipe, guac, rancher-fleet, snyk-cli, xeol, bom, trivy-operator, flux, osv-scanner, kots, tfsec, src-fingerprint, flux-image-automation-controller, kubescape, trufflehog, kubevela, kanik...

GO-2026-4717 Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo

Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo...

CVE-2026-25365

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...

EUVD-2026-15687

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...

CVE-2026-25365

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...

CVE-2026-25365

CVE-2026-25365 describes a Missing Authorization vulnerability in the Kargo Takip WordPress plugin affecting versions < 0.2.4. Public sources flag Missing Authorization for Kargo Takip (

CVE-2026-25365 WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...

CVE-2026-25365 WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...

SUSE CVE-2026-32828

Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery SSRF against link-local addresses, most...

WordPress plugin Kargo Takip 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

PT-2026-27923

Name of the Vulnerable Software and Affected Versions Kargo Takip versions prior to 0.2.4 Description A missing authorization flaw exists in Özgür KARALAR Kargo Takip kargo-takip-turkiye. This issue stems from incorrectly configured access control security levels, potentially allowing unauthorize...