CLEANSTART-2026-ZC37242 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the argo-workflows package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-MO36230 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the argo-workflows package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CLEANSTART-2026-CT50806 proxy-addr is a Node

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

CLEANSTART-2026-UX64069 brace-expansion through 5

Security vulnerability affects the argo-workflows package. brace-expansion through 5...

CLEANSTART-2026-LI51874 ajv (Another JSON Schema Validator) before 8

Security vulnerability affects the argo-workflows package. ajv Another JSON Schema Validator before 8...

CLEANSTART-2026-JC29454 shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`

Security vulnerability affects the argo-workflows package. shell-quote's quote function did not validate object-token inputs against the operator model used by parse...

CLEANSTART-2026-IW41585 Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)

Security vulnerability affects the argo-workflows package. Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP...

CLEANSTART-2026-YP71485 Immutable

Security vulnerability affects the argo-workflows package. Immutable...

CVE-2026-71899: Incorrect Authorization

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-21858

CVE-2026-21858 n8n工作流自动化平台 - 远程代码执行 一个用于检测CVE-2026-21858的安全研究工具，该漏洞是n8n工作流自动化平台中的一个严重远程代码执行漏洞。 目录 漏洞摘要 受影响版本 技术分析 先决条件 安装 使用方法 输出参考 检测方法 缓解与修复 入侵指标 法律声明 参考资料 致谢 漏洞摘要 字段| 值 ---|--- CVE标识符| CVE-2026-21858 CVSS v3.1评分| 10.0 严重 CVSS向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE分类| CWE-94：代码生成控制...

CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

Kibana 9.4.7, 9.5.0 Security Update (ESA-2026-85)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations...

CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-55563: Incorrect Authorization

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ListArchivedWorkflows handler in server/workflowarchive/archivedworkflowserver.go. An attacker can read archived workflows from other namespaces by sending a metadata.namespace!=...

EUVD-2026-83619

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass in the ListArchivedWorkflows API. The root cause is a failure to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals (negated) operator . An attacker with namespace-scoped list...

CVE-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...