EUVD-2026-25267

Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: npm, langfuse, kubeflow-centraldashboard, renovate, sqlpad, kubeflow-katib, kubeflow-pipelines, opensearch-dashboards, prism, saf, jitsucom-jitsu, code-server, py3-jupyterlab, nextcloud-server, argo-workflows...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: openbao, grafana-alloy, teleport, azure-service-operator, dapr, timescaledb-parallel-copy, wal-g, step-ca, bento, kine, gitness, splunk-otel-collector, cloudnative-pg, amass, argo-workflows, hydra, sftpgo-plugin-eventstore, kuma, steampipe, sqlexporter, src, temporal...

GHSA-W5HQ-G745-H8PQ vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, tensorflow-cpu-jupyter, opensearch-dashboards-fips, saf, py3-captum, prism, jitsucom-jitsu, renovate, gitlab-rails-ce-fips, gemini-cli, redisinsight, kubeflow-centraldashboard, gitlab-rails-ce, npm, kubeflow-katib, kubeflow-pipelines, sqlpad,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, keda, cloudprober-fips, gitlab-kas-fips, trillian-fips, vault-fips, sqlexporter-fips, goose-fips, ory-kratos, kuma, cerbos, gitlab-cng-fips, step, certificate-transparency-fips, gitness, cloudnative-pg-fips, ory-kratos-fips,...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886

The CVE describes an unchecked array index in Argo Workflows’ pod informer, specifically in podGCFromPod(), which can cause a controller-wide panic when a workflow pod has a malformed workflows.argoproj.io/pod-gc-strategy annotation. Affected versions span 3.6.5 through 4.0.4, with the panic occu...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

CVE-2026-40886 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod function causes a controller-wide panic when a workflow pod carries a malformed...

SUSE CVE-2026-5807

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.2 contained security vulnerabilities. These vulnerabilities stemmed from insufficient scope in the Zalo webhook replay de-duplication key, allowing legitimate events from...

PT-2026-34785

OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows...

Argo Workflows 输入验证错误漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 3.6.5 to 4.0.4 of Argo Workflows contain a vulnerability related to input validation errors. This vulnerability stems from insufficient array index checking in the podGCFromPod...

PT-2026-34719

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 3.6.5 through 3.6.19 Argo Workflows versions 3.7.0-rc1 through 3.7.12 Argo Workflows versions 4.0.0-rc1 through 4.0.4 Description An unchecked array index in the pod informer's podGCFromPod function causes a...

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

A Time-of-Check to Time-of-Use TOCTOU vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup via ftsaccpath rather than binding the traversal and label application to the specific directory...

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Our research on Void Dokkaebi’s operations uncovered a campaign that turns infected developer repositories into malware delivery channels. By spreading through trusted workflows, organizational codebases, and open-source projects, the threat can scale from a single compromise to a broader supply...

vantix

Vantix Vantix is a Codex-native offensive-security control pl...

[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data

In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanaged non-human identities that nobody was watching. For every employee in your org, there are 40 to 50 automated credentials: service accounts, API tokens, AI age...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: langfuse, configurable-http-proxy, kubeflow-katib, thingsboard, kubeflow-pipelines, lerna, opensearch-dashboards, prism, saf, code-server, nextcloud-server, argo-workflows...