Argoproj
38 CVEs tracked since 2022. Since Feb 2022, none of them reached CISA KEV.
Argoproj CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2022-02 | 2 | 0 |
| 2022-03 | 3 | 0 |
| 2022-04 | null or fewer | |
| 2022-05 | 4 | 0 |
| 2022-06 | 5 | 0 |
| 2022-07 | 3 | 0 |
| 2022-08 | null or fewer | |
| 2022-09 | null or fewer | |
| 2022-10 | null or fewer | |
| 2022-11 | null or fewer | |
| 2022-12 | null or fewer | |
| 2023-01 | null or fewer | |
| 2023-02 | null or fewer | |
| 2023-03 | null or fewer | |
| 2023-04 | null or fewer | |
| 2023-05 | null or fewer | |
| 2023-06 | null or fewer | |
| 2023-07 | null or fewer | |
| 2023-08 | null or fewer | |
| 2023-09 | 3 | 0 |
| 2023-10 | null or fewer | |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | null or fewer | |
| 2024-03 | 6 | 0 |
| 2024-04 | null or fewer | |
| 2024-05 | null or fewer | |
| 2024-06 | null or fewer | |
| 2024-07 | null or fewer | |
| 2024-08 | null or fewer | |
| 2024-09 | null or fewer | |
| 2024-10 | null or fewer | |
| 2024-11 | null or fewer | |
| 2024-12 | null or fewer | |
| 2025-01 | null or fewer | |
| 2025-02 | null or fewer | |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | 5 | 0 |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | null or fewer | |
| 2026-02 | null or fewer | |
| 2026-03 | null or fewer | |
| 2026-04 | null or fewer | |
| 2026-05 | 7 | 0 |
Products
The products that kept showing up in Argoproj's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Argoproj.
- CVE-2026-93991Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector7.7
- CVE-2026-82277Argo Rollouts Dashboard Unauthenticated Mutating Operations9.8
- CVE-2026-54526Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing9.9
- CVE-2026-45737Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations6.3
- CVE-2026-45738Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation7.3
- CVE-2026-15416Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint8.9
- CVE-2026-62185Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE7.6
- CVE-2026-42296Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure8.1
- CVE-2026-42295Argo Workflows: Exposure of artifact repository credentials4.9
- CVE-2026-42294Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor7.5
- CVE-2026-42183Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)6.5
- CVE-2026-42297Argo Workflows Is Missing Authorization in Sync ConfigMap Provider8.3
- CVE-2026-42880ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction9.6
- CVE-2026-43824In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.7.7
- CVE-2026-40886Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller7.7
The record
- Peak rank
- #125 in Mar 2024
- Busiest month shown
- May 2026, 7 CVEs
- Months with a KEV entry
- 0 since Feb 2022
- Monthly snapshots
- 9 since 2022