AR
Product
argo-cd
63
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 12High 22Medium 29Low 0
Watch
Add argo-cd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-23135 | 5.5 | May 12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs Affected: 1.7.0 before 1.7.14; 1.8.0 before 1.8.7 |
| CVE-2025-47933 | 5.4 | May 29 | Argo CD allows cross-site scripting on repositories page Affected: >= 1.2.0-rc1, <= 1.8.7; >= 2.0.0-rc3, < 2.13.8; >= 2.14.0-rc1, < 2.14.13; >= 3.0.0-rc1, < 3.0.4 |
| CVE-2024-28175 | 5.4 | Mar 13 | Cross-site scripting on application summary component in argo-cd Affected: >= 1.0.0, < 2.8.12; >= 2.9.0, < 2.9.8; >= 2.10.0, < 2.10.3 |
| CVE-2022-31035 | 5.4 | Jun 27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.0.0 before 2.1.16; 2.2.9; 2.3.4; 2.4.0 |
| CVE-2025-55191 | 5.3 | Sep 30 | Repository Credentials Race Condition Crashes Argo CD Server Affected: >= 2.1.0, < 2.14.20; = 3.2.0-rc1; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19 |
| CVE-2020-11576 | 5.3 | Apr 8 | Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because… Affected: 1.5.0 |
| CVE-2022-24731 | 4.9 | Mar 23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.5.0 before 2.1.11; 2.2.0 before 2.2.6; 2.3.0; 2.3.0; 2.3.0; 2.3.0 |
| CVE-2021-23347 | 4.8 | Mar 3 | The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would… Affected: before 1.7.13; 1.8.0 before 1.8.6 |
| CVE-2024-36106 | 4.3 | Jun 6 | Argo CD allows authenticated users to enumerate clusters by name Affected: > 0.11.0, < 2.9.17; >= 2.10.0, < 2.10.12; >= 2.11.0, < 2.11.3 |
| CVE-2023-40026 | 4.3 | Sep 27 | Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server Affected: < 2.3 |
| CVE-2022-31036 | 4.3 | Jun 27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.3.0 before 2.1.6; 2.2.9; 2.3.4; 2.4.0 |
| CVE-2022-24905 | 4.3 | May 20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 0.6.1 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4 |
| CVE-2022-24904 | 4.3 | May 20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 0.7.0 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4 |