GO-2026-4910 vulnerabilities

Vulnerabilities for packages: skaffold, gitea, gptscript, pulumi, snyk-cli, external-secrets-operator, flux-source-controller, tfsec, kubevela, trivy, melange, crossplane, apko, pulumi-language-dotnet, rancher-fleet, kyverno, nuclei, k9s, gitsign, trivy-operator, flux-image-automation-controller,...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2024-2605 vulnerabilities

Vulnerabilities for packages: caddy, trillian, argo-workflows, kots, step-ca, step...

GO-2025-4023 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2026-5235 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2026-5527 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kargo, k8sgpt, kubeflow-pipelines, opentelemetry-collector, argo-workflows, amazon-cloudwatch-agent, nats, splunk-otel-collector, opentelemetry-collector-contrib, grafana-alloy, argo-rollouts...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: caddy, ferretdb, src, temporal-server, kine, trillian, argo-workflows, k3s, kube-bench, amass, spicedb, kots, step-ca, step...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: spire-server, opentelemetry-collector, pulumi, up, flux-source-controller, boring-registry, rclone, restic, sigstore-scaffolding, trivy, velero, sops, py3-azure-identity, thanos, nuclei, sqlpad, k8sgpt, hugo-extended, bank-vaults, py3-cassandra-medusa, kubescape,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server, oauth2-proxy, flux-source-controller, cloudflared, sops, vexctl, gitsign, kubescape, flux-kustomize-controller, slsa-verifier, tekton-chains, tkn, dex, argo-workflows, fulcio, terragrunt, cosign, aactl, kots, rekor...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

GHSA-48P8-G2FX-3WWM Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-GP43617 Security fixes in argo-workflows 3.7.17-r2

Package argo-workflows version 3.7.17-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-EU00318 Security fixes in argo-workflows 3.7.17-r1

Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...

CLEANSTART-2026-QH76136 Security fixes in argo-workflows-fips 4.0.6-r1

Package argo-workflows-fips version 4.0.6-r1 fixes 8 vulnerabilities: ghsa-crhj-59gh-8x96, ghsa-389r-gv7p-r3rp, ghsa-m7cr-m3pv-hgrp, ghsa-w5pp-99ch-qj29, CVE-2026-45022...

PT-2026-85890

Package argo-workflows version 3.7.17-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

PT-2026-85868

Package argo-workflows version 3.7.17-r1 fixes 16 vulnerabilities: ghsa-3ppc-4f35-3m26, ghsa-7r86-cg39-jmmj, ghsa-23c5-xmqv-rm74, ghsa-xv26-6w52-cph6, ghsa-q3j6-qgpj-74h6...

CVE-2026-72765

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...

CVE-2026-72765 n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...