Building Effective Agents with Spring AI (Part 1)

In a recent research publication: Building effective agents, Anthropic shared valuable insights about building effective Large Language Model LLM agents. What makes this research particularly interesting is its emphasis on simplicity and composability over complex frameworks. Let's explore how...

GHSA-CWPG-QGC6-JXVQ vulnerabilities

Vulnerabilities for packages: kubeflow-katib, argo-workflows, newrelic-fluent-bit-output...

CVE-2025-21614 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, argo-workflows, kaniko, kubescape, pulumi-language-dotnet, src-fingerprint-fips, go-licenses, kaniko-fips, packer, task, apko, argocd-image-updater, flux-fips, goreleaser, argo-events, pulumi-language-java, kargo, grype, argo-cd,...

Sensitive Information Exposure

github.com/argoproj/argo-workflows/v3 is vulnerable to a Sensitive Information Exposure. The vulnerability is due to the absence of proper authentication checks in the GET Workflow endpoint when retrieving Archived Workflows. Specifically, when using --auth-mode=client, fake or spoofed tokens can...

SUSE CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

GHSA-RHX6-C78J-4Q9W vulnerabilities

Vulnerabilities for packages: argo-workflows, tileserver-gl, thingsboard, grafana-image-renderer, kubeflow-pipelines, sqlpad, arangodb, kubeflow-centraldashboard, tileserver-gl-fips...

Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

CVE-2024-54675

CVE-2024-54675 affects MISP up to version 2.5.2, with a stored cross-site scripting (XSS) flaw in the editor interface (app/webroot/js/workflows-editor/workflows-editor.js) used for ad-hoc workflows. The root cause is a stored XSS vulnerability in the editor that can impact users who load the aff...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

GHSA-H36C-M3RF-34H9 vulnerabilities

Vulnerabilities for packages: argo-workflows, argo-workflows-fips...

GHSA-H36C-M3RF-34H9 vulnerabilities

Vulnerabilities for packages: argo-workflows...

GHSA-H36C-M3RF-34H9 Access to Archived Argo Workflows with Fake Token in `client` mode

Summary When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name When using --auth-mode=sso, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint:...

CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

GO-2024-3303 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows

Argo Workflows Allows Access to Archived Workflows with Fake Token in client mode in github.com/argoproj/argo-workflows...

CVE-2024-53862

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

CVE-2024-53862 vulnerabilities

Vulnerabilities for packages: argo-workflows...

CVE-2024-53862 vulnerabilities

Vulnerabilities for packages: argo-workflows, argo-workflows-fips...

CVE-2024-53862 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

CVE-2024-53862

CVE-2024-53862 affects Argo Workflows (Kubernetes) where, in --auth-mode=client, archived workflows could be retrieved with a fake token due to a missing auth check, and in --auth-mode=sso all archived workflows could be retrieved with a valid token. The vaulting component that should validate to...