Threats affecting pkg:generic/lucene

A security vulnerability exists in the argo-workflows package affecting versions prior to 4.0.15-r2 due to an issue in the uri-js dependency. The flaw has a CVSS 3.1 base score of 6.5, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality and integrity. A fix is available in version 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-93749) affects the argo-workflows package due to an issue in the source-map-js dependency through version 1. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 of argo-workflows address this issue.

A high-severity security vulnerability (CVE-2026-93690) affects the argo-workflows package due to an issue in the uri-js dependency through version 4. This vulnerability impacts availability without affecting confidentiality or integrity. A fix is available in version 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-93687) affects the argo-workflows package versions prior to 4.0.15-r2. The flaw does not impact confidentiality or integrity but causes a significant availability impact. A patch is available in version 4.0.15-r2 to address this issue.

A high-severity security vulnerability exists in the argo-workflows package where the shell-quote library's quote() function fails to properly validate object-token inputs against the operator model used by the parse() function. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has been assigned CVE-2026-9277 and has a CVSS score of 8.1, indicating a significant risk. Fixed versions 4.1.6-r1 and 4.0.15-r2 have been released to address this issue.

A critical security vulnerability (CVE-2026-90711) affects the argo-workflows package due to an issue with the proxy-addr component in Node.js. The flaw allows for network-based exploitation without requiring privileges or user interaction, resulting in high confidentiality and integrity impact. Fixed versions 4.1.6-r1 and 4.0.15-r2 address this vulnerability.

A high-severity security vulnerability (CVE-2026-87776) affects the argo-workflows package in versions prior to 4.1.6-r1 and 4.0.15-r2. The issue involves the compression component being identified as a Node, leading to an impact on availability. The vulnerability has a CVSS score of 7.5 and has been fixed in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-85393) affects the argo-workflows package due to an issue in the node-forge dependency through version 1. Versions of argo-workflows prior to 4.0.15-r2 are impacted. The vulnerability allows for integrity impact without confidentiality or availability loss. A patch is available in version 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-84375) affects the argo-workflows package due to an issue in js-yaml, a JavaScript YAML parser and dumper. The vulnerability impacts availability and has been addressed in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-76844) affects the argo-workflows package due to an issue in zlib 1. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause integrity and availability impacts without requiring privileges or user interaction. A patch is available to address this vulnerability.

A high-severity security vulnerability (CVE-2026-73089) affects the argo-workflows package due to an issue related to Browserslist, a configuration tool for sharing target browsers and Node.js versions. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 address this issue.

A high-severity security vulnerability (CVE-2026-73088) affects the argo-workflows package due to an issue related to Browserslist, a configuration tool for sharing target browsers and Node.js versions. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.

A high-severity vulnerability in the argo-workflows package involves the brace-expansion library generating arbitrary strings with a common prefix and suffix. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability does not impact confidentiality or integrity but causes a denial of service by affecting availability. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability exists in the argo-workflows package related to webpack-dev-server versions up to and including 5. The vulnerability has a CVSS score of 6.5 and impacts confidentiality with no impact on integrity or availability. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.

CVE-2026-59880 is a high-severity security vulnerability in the argo-workflows package that causes an immutable condition leading to availability impact. It affects versions prior to 4.1.6-r1 and 4.0.15-r2. A patch is available to address this issue.

A high-severity security vulnerability (CVE-2026-59879) affects the argo-workflows package, specifically versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability is classified as immutable and impacts availability without affecting confidentiality or integrity. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-59869) affects the argo-workflows package due to an issue in the js-yaml JavaScript YAML parser and dumper. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 address the issue.

A high-severity security vulnerability (CVE-2026-55602) affects the argo-workflows package due to an issue in the http-proxy-middleware component used in Node.js environments. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a complete compromise of integrity without affecting confidentiality or availability. The vulnerability has been fixed in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability (CVE-2026-54490) affects the argo-workflows package, specifically in the websocket-driver component, which is a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-54466) affects the argo-workflows package's websocket-driver component, a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a high impact on integrity without requiring privileges or user interaction. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.