CVE-2024-47764 is a medium-severity security vulnerability in the argo-workflows package, specifically affecting the 'cookie' component, which is a basic HTTP cookie parser and serializer for HTTP servers. Versions prior to 4.0.15-r2 are affected. A fix is available in version 4.0.15-r2.
A security vulnerability exists in the argo-workflows package due to an issue in the minimatch utility, which converts glob expressions into JavaScript RegExp objects. This vulnerability affects versions prior to 4.0.15-r2 and 4.1.6-r1. The flaw has a CVSS 4.0 base score of 6.9, indicating a medium severity level. A fix is available in versions 4.0.15-r2 and 4.1.6-r1.
A high-severity vulnerability (CVE-2026-118664) affects the argo-workflows package where the use of decodeURIComponent is less robust compared to decode-uri-component. This flaw is addressed in versions 4.0.15-r2 and 4.1.6-r1, which provide fixes. The vulnerability has a CVSS 4.0 score of 8.2, indicating significant impact if exploited. No known exploits are reported in the wild.
A security vulnerability (CVE-2026-116689) affects the argo-workflows package due to an issue in the follow-redirects Node.js module. The vulnerability impacts versions of argo-workflows prior to 4.1.6-r1. It has a medium severity with a CVSS score of 5.9, indicating a network attack vector with high complexity and no privileges or user interaction required. A fix is available in version 4.1.6-r1.
A security vulnerability exists in the argo-workflows package related to the Serialize JavaScript functionality, which serializes JavaScript values to a superset of JSON including regular expressions and functions. This vulnerability affects versions prior to 4.0.15-r2 and 4.1.6-r1. The issue has a low severity score and a CVSS score of 2.1. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability has been identified in the argo-workflows package related to the serialize-javascript dependency version 7. This vulnerability affects versions of argo-workflows prior to 4.0.15-r2 and 4.1.6-r1. The issue has a medium severity rating with a CVSS score of 4.7. A patch is available in versions 4.0.15-r2 and 4.1.6-r1 to address this vulnerability.
A security vulnerability exists in the argo-workflows package affecting versions prior to 4.1.6-r1. The issue relates to the webpack-dev-server component, which is a development server providing live reloading for webpack projects. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package affects the launch-editor feature, which allows users to open files with line numbers in an editor from Node. This flaw is present in versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a medium severity rating with a CVSS score of 6.3. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability in the argo-workflows package affects the launch-editor feature, which allows users to open files with line numbers in an editor from Node. This flaw is present in versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a medium severity rating with a CVSS score of 6.3. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability in the argo-workflows package affects the launch-editor feature, which allows users to open files with line numbers in an editor from Node. This flaw is present in versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a high severity score of 7.5 and has been officially fixed in versions 4.0.15-r2 and 4.1.6-r1.
A high-severity security vulnerability affects the argo-workflows package due to an issue involving webpack-dev-server, a development server that provides live reloading for webpack projects. The vulnerability impacts versions of argo-workflows prior to 4.0.15-r2 and 4.1.6-r1. It has a CVSS 3.1 score of 8.2, indicating network exploitable conditions with high confidentiality impact and low integrity impact. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
CVE-2026-111943 is a vulnerability affecting Kubernetes and multiple related packages where Go uses the system root certificates on most platforms. This behavior can impact the trust model of TLS connections. Fixed versions are available for all affected packages.
A high-severity security vulnerability (CVE-2026-111756) affects the argo-workflows package due to an issue in the follow-redirects Node module. Versions of argo-workflows prior to 4.1.6-r1 are impacted. The vulnerability has a CVSS 4.0 base score of 8.2, indicating significant risk. A fix is available in version 4.1.6-r1.
A high-severity security vulnerability (CVE-2026-111755) affects the argo-workflows package versions prior to 4.1.6-r1. The issue involves the follow-redirects component in Node.js. A fix is available in version 4.1.6-r1.
A high-severity security vulnerability exists in the argo-workflows package due to an issue in the body-parser middleware for Node.js. The vulnerability affects versions prior to 4.0.15-r2 and 4.1.6-r1. It has a CVSS score of 7.5 with an impact on availability. Fixed versions are available.
A security vulnerability identified as CVE-2026-110910 affects the argo-workflows package. The issue impacts versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a low severity score of 3.7 and involves limited integrity impact without confidentiality or availability loss. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability identified as CVE-2026-110816 affects the argo-workflows package. The flaw has a CVSS score of 5.3, indicating a medium severity level. The vulnerability impacts versions prior to 4.0.15-r2 and 4.1.6-r1. It does not affect confidentiality or integrity but impacts availability. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
A security vulnerability exists in the argo-workflows package due to an issue in the fast-uri component, a dependency-free RFC 3986 URI parser and serializer for Node.js. The vulnerability affects versions prior to 4.1.6-r1. The CVSS v3.1 base score is 3.7, indicating a low severity issue with no confidentiality or availability impact but limited integrity impact. A fix is available in version 4.1.6-r1.
A security vulnerability has been identified in the argo-workflows package, specifically related to the fast-uri component, which is a dependency-free RFC 3986 URI parser and serializer for Node.js. Versions of argo-workflows prior to 4.1.6-r1 are affected. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity issue. It allows an attacker to cause partial confidentiality and integrity impacts with no availability impact. A fix is available in version 4.1.6-r1.
A security vulnerability exists in the argo-workflows package due to an issue in the fast-uri component, a dependency-free RFC 3986 URI parser and serializer for Node.js. Versions of argo-workflows prior to 4.1.6-r1 are affected. The vulnerability has a low severity score and involves limited impact on integrity without affecting confidentiality or availability. A fix is available in version 4.1.6-r1.