Aargoproj

Products

Exploited and recent CVEs

• CVE-2026-113709 Critical 9.9 Argo CD: A Kustomize Helm config home can run commands in the repo-server 0.5%
• CVE-2026-113708 Critical 9.9 Argo CD: A Kustomize remote ref can run commands in the repo-server 0.7%
• CVE-2026-113672 Critical 9.9 Argo CD: A Jsonnet import can read files from the repo-server 0.8%
• CVE-2026-77459 Critical 9.9 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks 0.5%
• CVE-2026-55797 High 8.8 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL 1.9%
• CVE-2026-93991 High 7.7 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector 0.4%
• CVE-2026-82277 Critical 9.8 Argo Rollouts Dashboard Unauthenticated Mutating Operations 0.8%
• CVE-2026-54526 High 8.9 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing 0.6%
• CVE-2026-45737 Medium 6.3 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations 0.5%
• CVE-2026-45738 High 7.3 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation 0.6%
• CVE-2026-15416 High 8.9 Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint 0.5%
• CVE-2026-62185 High 7.6 Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE 0.5%
• CVE-2026-42296 High 8.1 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure 0.4%
• CVE-2026-42295 High 8.5 Argo Workflows: Exposure of artifact repository credentials 0.4%
• CVE-2026-42294 High 7.5 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor 0.6%
• CVE-2026-42183 Low 2.3 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) 0.4%
• CVE-2026-42297 High 8.3 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider 0.5%
• CVE-2026-42880 Critical 9.6 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction 0.6%
• CVE-2026-43824 High 7.7 In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. 0.3%
• CVE-2026-40886 High 7.7 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller 0.4%
• CVE-2026-31892 Critical 9.9 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode 0.6%
• CVE-2026-28229 Critical 9.8 Argo Workflows has unauthorized access to Argo Workflows Template 0.7%
• CVE-2026-23960 High 7.1 Argo Workflows affected by stored XSS in the artifact directory listing 0.4%
• CVE-2025-66626 High 8.1 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links 0.7%
• CVE-2025-62157 High 8.5 Argo Workflows exposes artifact repository credentials in workflow-controller logs 0.5%
• CVE-2025-62156 High 8.1 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite 0.6%
• CVE-2025-59538 High 7.5 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook 9.4%
• CVE-2025-59537 High 7.5 argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload 0.6%
• CVE-2025-59531 High 7.5 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload 0.6%
• CVE-2025-55191 Medium 6.5 Repository Credentials Race Condition Crashes Argo CD Server 0.5%