argoproj argo-workflows

• CVE-2026-93991 High 7.7 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector 0.4%
• CVE-2026-54526 High 8.9 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing 0.6%
• CVE-2026-42296 High 8.1 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure 0.4%
• CVE-2026-42295 High 8.5 Argo Workflows: Exposure of artifact repository credentials 0.4%
• CVE-2026-42294 High 7.5 Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor 0.6%
• CVE-2026-42183 Low 2.3 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) 0.4%
• CVE-2026-42297 High 8.3 Argo Workflows Is Missing Authorization in Sync ConfigMap Provider 0.5%
• CVE-2026-40886 High 7.7 Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller 0.4%
• CVE-2026-31892 Critical 9.9 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode 0.6%
• CVE-2026-28229 Critical 9.8 Argo Workflows has unauthorized access to Argo Workflows Template 0.7%
• CVE-2026-23960 High 7.1 Argo Workflows affected by stored XSS in the artifact directory listing 0.4%
• CVE-2025-66626 High 8.1 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links 0.7%
• CVE-2025-62157 High 8.5 Argo Workflows exposes artifact repository credentials in workflow-controller logs 0.5%
• CVE-2025-62156 High 8.1 argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite 0.6%
• CVE-2024-53862 Medium 6.3 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode 0.7%
• CVE-2024-47827 Medium 5.7 Argo Workflows Controller: Denial of Service via malicious daemon Workflows 0.4%
• CVE-2022-29164 High 7.1 Privilege Escalation in argo-workflows 0.9%