Skip to content
Noroxi

argoproj records

75 published records for vendor argoproj.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
90.7%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

75 records
  • CVE-2025-55190
    41Plan

    Argo CD: Project API Token Exposes Repository Credentials

    CriticalCVSS 9.9Proof of conceptEPSS 5%

    argoproj · argo cdSep 4, 2025

  • CVE-2022-29165
    41Plan

    Argo CD will blindly trust JWT claims if anonymous access is enabled

    CriticalCVSS 10.0No exploitEPSS 2%

    argoproj · argo cdMay 20, 2022

  • CVE-2024-21652
    39Monitor

    Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss

    CriticalCVSS 9.8No exploitEPSS 0%

    argoproj · argo cdMar 18, 2024

  • CVE-2023-40029
    38Monitor

    Cluster secret might leak in cluster details page in Argo CD

    CriticalCVSS 9.6Proof of conceptEPSS 1%

    argoproj · argo cdSep 7, 2023

  • CVE-2022-31105
    38Monitor

    Argo CD's certificate verification is skipped for connections to OIDC providers

    CriticalCVSS 9.6No exploitEPSS 0%

    argoproj · argo cdJul 12, 2022

  • CVE-2026-42880
    38Monitor

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    argoproj · argo cdMay 7, 2026

  • CVE-2020-8828
    36Monitor

    As of v1.5.0, the default admin password is set to the argocd-server pod name.

    HighCVSS 8.8No exploitEPSS 1%

    argoproj · argo cdApr 8, 2020

  • CVE-2024-31989
    36Monitor

    ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

    CriticalCVSS 9.0Proof of conceptEPSS 1%

    argoproj · argo cdMay 21, 2024

  • CVE-2024-21662
    36Monitor

    Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow

    CriticalCVSS 9.1No exploitEPSS 0%

    argoproj · argo cdMar 18, 2024

  • CVE-2022-1025
    35Monitor

    All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potent

    HighCVSS 8.8No exploitEPSS 1%

    argoproj · argo cdJul 12, 2022

  • CVE-2022-24768
    35Monitor

    Improper access control allows admin privilege escalation in Argo CD

    HighCVSS 8.8No exploitEPSS 1%

    argoproj · argo cdMar 23, 2022

  • CVE-2023-22482
    35Monitor

    JWT audience claim is not verified

    HighCVSS 8.8No exploitEPSS 0%

    argoproj · argo cdJan 26, 2023

  • CVE-2025-62156
    35Monitor

    argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite

    HighCVSS 8.8No exploitEPSS 0%

    argoproj · argo workflowsOct 14, 2025

  • CVE-2026-31892
    35Monitor

    WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

    HighCVSS 8.9No exploitEPSS 0%

    argoproj · argo workflowsMar 11, 2026

  • CVE-2026-54526
    35Monitor

    Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

    HighCVSS 8.9No exploitEPSS 0%

    argoproj · argo workflowsJul 16, 2026

  • CVE-2023-22736
    34Monitor

    argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

    HighCVSS 8.5No exploitEPSS 0%

    argoproj · argo cdJan 26, 2023

  • CVE-2023-23947
    34Monitor

    Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets

    HighCVSS 8.5No exploitEPSS 0%

    argoproj · argo cdFeb 16, 2023

  • CVE-2026-45738
    34Monitor

    Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

    HighCVSS 8.7No exploitEPSS 0%

    argoproj · argo cdJul 15, 2026

  • CVE-2026-42297
    34Monitor

    Argo Workflows Is Missing Authorization in Sync ConfigMap Provider

    HighCVSS 8.5No exploitEPSS 0%

    argoproj · argo workflowsMay 9, 2026

  • CVE-2025-62157
    34Monitor

    Argo Workflows exposes artifact repository credentials in workflow-controller logs

    HighCVSS 8.5No exploitEPSS 0%

    argoproj · argo workflowsOct 14, 2025

  • CVE-2026-42295
    34Monitor

    Argo Workflows: Exposure of artifact repository credentials

    HighCVSS 8.5No exploitEPSS 0%

    argoproj · argo workflowsMay 9, 2026

  • CVE-2025-59538
    33Monitor

    Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

    HighCVSS 7.5No exploitEPSS 10%

    argoproj · argo cdOct 1, 2025

  • CVE-2024-22424
    33Monitor

    Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd

    HighCVSS 8.3No exploitEPSS 0%

    argoproj · argo cdJan 18, 2024

  • CVE-2022-31034
    32Monitor

    Insecure entropy in argo-cd

    HighCVSS 8.1No exploitEPSS 0%

    argoproj · argo cdJun 27, 2022

  • CVE-2026-42294
    32Monitor

    Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor

    HighCVSS 8.2No exploitEPSS 0%

    argoproj · argo workflowsMay 9, 2026