argoproj Argo CD

• CVE-2026-113709 Critical 9.9 Argo CD: A Kustomize Helm config home can run commands in the repo-server 0.5%
• CVE-2026-113708 Critical 9.9 Argo CD: A Kustomize remote ref can run commands in the repo-server 0.7%
• CVE-2026-113672 Critical 9.9 Argo CD: A Jsonnet import can read files from the repo-server 0.8%
• CVE-2026-77459 Critical 9.9 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks 0.5%
• CVE-2026-55797 High 8.8 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL 1.9%
• CVE-2026-45737 Medium 6.3 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations 0.5%
• CVE-2026-45738 High 7.3 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation 0.6%
• CVE-2026-42880 Critical 9.6 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction 0.6%
• CVE-2026-43824 High 7.7 In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. 0.3%
• CVE-2025-59538 High 7.5 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook 9.4%
• CVE-2025-59537 High 7.5 argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload 0.6%
• CVE-2025-59531 High 7.5 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload 0.6%
• CVE-2025-55191 Medium 6.5 Repository Credentials Race Condition Crashes Argo CD Server 0.5%
• CVE-2025-55190 Critical 10.0 Argo CD: Project API Token Exposes Repository Credentials 5.7%
• CVE-2025-47933 Critical 9.1 Argo CD allows cross-site scripting on repositories page 0.5%
• CVE-2025-23216 Medium 6.8 Argo CD does not scrub secret values from patch errors 0.5%
• CVE-2024-41666 Medium 4.7 The Argo CD web terminal session does not handle the revocation of user permissions properly. 0.7%
• CVE-2024-40634 High 7.5 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint 1.4%
• CVE-2024-37152 Medium 5.3 Unauthenticated Access to sensitive settings in Argo CD 2.3%
• CVE-2024-36106 Medium 4.3 Argo CD allows authenticated users to enumerate clusters by name 0.4%
• CVE-2024-31989 Critical 9.1 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache 1.5%
• CVE-2024-32476 Medium 6.5 Denial of Service via malicious jqPathExpressions in ignoreDifferences 1.0%
• CVE-2024-31990 Medium 4.8 Argo CD' API server does not enforce project sourceNamespaces 0.4%
• CVE-2024-29893 Medium 6.5 Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server 1.0%
• CVE-2024-21662 High 7.5 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow 0.8%
• CVE-2024-21661 High 7.5 Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment 1.2%
• CVE-2024-21652 Critical 9.8 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss 0.8%
• CVE-2023-50726 Medium 6.4 Users with `create` but not `override` privileges can perform local sync in argo-cd 0.5%
• CVE-2024-28175 Critical 9.1 Cross-site scripting on application summary component in argo-cd 0.7%
• CVE-2024-22424 High 8.4 Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd 0.5%
• CVE-2023-40026 Medium 5.0 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server 0.6%
• CVE-2023-40584 Medium 6.5 Denial of Service to Argo CD repo-server 1.4%
• CVE-2023-40029 Critical 9.9 Cluster secret might leak in cluster details page in Argo CD 1.2%
• CVE-2023-40025 Medium 4.7 Argo CD web terminal session doesn't expire 0.6%
• CVE-2023-23947 Critical 9.1 Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets 0.7%
• CVE-2023-25163 Medium 6.3 Argo CD leaks repository credentials in user-facing error messages and in logs 0.8%
• CVE-2023-22736 High 8.6 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled 0.8%
• CVE-2023-22482 Critical 9.1 JWT audience claim is not verified 0.9%
• CVE-2022-31102 Low 2.6 Cross-site Scripting for Argo CD single sign on users 0.6%
• CVE-2022-31105 High 8.3 Argo CD's certificate verification is skipped for connections to OIDC providers 0.8%
• CVE-2022-31036 Medium 4.3 Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server 0.9%
• CVE-2022-31035 Critical 9.0 External URLs for Deployments can include javascript in argo-cd 1.0%
• CVE-2022-31034 High 8.3 Insecure entropy in argo-cd 1.0%
• CVE-2022-31016 Medium 6.5 Argo CD vulnerable to Uncontrolled Memory Consumption 0.9%
• CVE-2022-29165 Critical 10.0 Argo CD will blindly trust JWT claims if anonymous access is enabled 2.1%
• CVE-2022-24905 Medium 4.3 Argo CD login screen allows message spoofing if SSO is enabled 1.3%
• CVE-2022-24904 Medium 4.3 Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server 1.2%
• CVE-2022-24768 Critical 9.9 Improper access control allows admin privilege escalation in Argo CD 1.2%
• CVE-2022-24731 Medium 6.8 Path traversal allows leaking out-of-bound files from Argo CD repo-server 1.0%
• CVE-2022-24730 High 7.7 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server 0.9%