GHSA-WR3J-PWJ9-HQQ6 vulnerabilities

Vulnerabilities for packages: argo-workflows...

GHSA-CWPG-QGC6-JXVQ vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, argo-workflows...

CVE-2024-9096 Improper Authorization in lunary-ai/lunary

In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks proper access control, such as middleware to ensure that only authorized users e.g., project owners or admins can modify checklist data. This...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: nats, opentelemetry-collector, tempo, opentelemetry-collector-contrib, argo-cd, argo-rollouts, k8sgpt, grafana-alloy, amazon-cloudwatch-agent, kargo, splunk-otel-collector, kubeflow-pipelines, coredns, argo-workflows...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: nats, opentelemetry-collector, tempo, opentelemetry-collector-contrib, argo-cd, argo-rollouts, k8sgpt, grafana-alloy, amazon-cloudwatch-agent, kargo, splunk-otel-collector, kubeflow-pipelines, coredns, argo-workflows...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: tempo-fips, opentelemetry-collector-fips, grafana-alloy-fips, elastic-agent-fips, kubeflow-pipelines, argo-cd, eks-distro, opentelemetry-collector-contrib-fips, argo-rollouts-fips, keda-fips, k8sgpt, opentelemetry-collector-contrib, keda, coredns-fips, nats,...

From Vulnerability Scanning to Risk Management: The Complete VMDR Advantage

What if your vulnerability management tool did more than just scan and instead helped you take control of cyber risks across your business? CISA defines “vulnerability management” as the process by which organizations identify, analyze, and manage vulnerabilities in a critical service’s operating...

GHSA-67MH-4WV8-2F99 vulnerabilities

Vulnerabilities for packages: vitess, vite, argo-workflows...

GHSA-67MH-4WV8-2F99 vulnerabilities

Vulnerabilities for packages: vitess, vite, argo-workflows...

CVE-2022-29164

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

CVE-2022-39395

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to...

CVE-2022-39326

kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the run-terraform reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a...

CVE-2024-27920

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing cust...

Building Effective Agents with Spring AI (Part 1)

In a recent research publication: Building effective agents, Anthropic shared valuable insights about building effective Large Language Model LLM agents. What makes this research particularly interesting is its emphasis on simplicity and composability over complex frameworks. Let's explore how...

GHSA-CWPG-QGC6-JXVQ vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, argo-workflows...

CVE-2025-21614 vulnerabilities

Vulnerabilities for packages: src-fingerprint-fips, trivy-fips, kyverno, apko, melange, trivy, dagger, datadog-agent, gitea-fips, goreleaser, grafana-alloy-fips, nuclei, datadog-agent-fips, tfsec, flux-image-automation-controller-fips, zot, tekton-pipelines, nemo, go-licenses, scorecard, pulumi,...

Sensitive Information Exposure

github.com/argoproj/argo-workflows/v3 is vulnerable to a Sensitive Information Exposure. The vulnerability is due to the absence of proper authentication checks in the GET Workflow endpoint when retrieving Archived Workflows. Specifically, when using --auth-mode=client, fake or spoofed tokens can...

SUSE CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

GHSA-RHX6-C78J-4Q9W vulnerabilities

Vulnerabilities for packages: grafana-image-renderer, sqlpad, kubeflow-centraldashboard, tileserver-gl, kubeflow-pipelines, thingsboard, argo-workflows, tileserver-gl-fips...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...