Threats affecting pkg:generic/mongoose

A high-severity security vulnerability (CVE-2026-73089) affects the argo-workflows package due to an issue related to Browserslist, a configuration tool for sharing target browsers and Node.js versions. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 address this issue.

A high-severity security vulnerability (CVE-2026-73088) affects the argo-workflows package due to an issue related to Browserslist, a configuration tool for sharing target browsers and Node.js versions. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.

A high-severity vulnerability in the argo-workflows package involves the brace-expansion library generating arbitrary strings with a common prefix and suffix. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability does not impact confidentiality or integrity but causes a denial of service by affecting availability. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability exists in the argo-workflows package related to webpack-dev-server versions up to and including 5. The vulnerability has a CVSS score of 6.5 and impacts confidentiality with no impact on integrity or availability. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.

CVE-2026-59880 is a high-severity security vulnerability in the argo-workflows package that causes an immutable condition leading to availability impact. It affects versions prior to 4.1.6-r1 and 4.0.15-r2. A patch is available to address this issue.

A high-severity security vulnerability (CVE-2026-59879) affects the argo-workflows package, specifically versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability is classified as immutable and impacts availability without affecting confidentiality or integrity. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-59869) affects the argo-workflows package due to an issue in the js-yaml JavaScript YAML parser and dumper. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 address the issue.

A high-severity security vulnerability (CVE-2026-55602) affects the argo-workflows package due to an issue in the http-proxy-middleware component used in Node.js environments. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a complete compromise of integrity without affecting confidentiality or availability. The vulnerability has been fixed in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability (CVE-2026-54490) affects the argo-workflows package, specifically in the websocket-driver component, which is a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-54466) affects the argo-workflows package's websocket-driver component, a WebSocket protocol handler with pluggable I/O. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause a high impact on integrity without requiring privileges or user interaction. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability in the argo-workflows package's launch-editor feature allows users to open files with line numbers in an editor from Node. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a medium severity rating with a CVSS score of 5.5. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available to address the issue.

A security vulnerability has been identified in the argo-workflows package due to its use of the js-yaml JavaScript YAML parser and dumper. The vulnerability affects versions prior to 4.1.6-r1 and 4.0.15-r2. It has a CVSS 3.1 base score of 5.3, indicating a medium severity level. The vulnerability does not impact confidentiality or integrity but can cause availability issues. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-48779) affects the argo-workflows package, which uses the ws WebSocket client and server for Node.js. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It has a CVSS score of 7.5 with an impact on availability. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.

A security vulnerability in the argo-workflows package causes the generation of a faulty regular expression when three or more parameters are present within a single segment separated by characters other than a period. This flaw can lead to a high-severity impact on availability. The issue affects versions prior to 4.1.6-r1 and 4.0.15-r2 and has been addressed in these fixed releases.

A high-severity security vulnerability (CVE-2026-45822) affects the argo-workflows package, specifically in versions prior to 4.1.6-r1 and 4.0.15-r2. The flaw involves the decode-uri-component functionality. A fix is available in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-45819) affects the argo-workflows package, specifically impacting versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant risk. A patch is available in versions 4.1.6-r1 and 4.0.15-r2 to address this issue.

A high-severity security vulnerability (CVE-2026-45736) affects the argo-workflows package, specifically related to the ws library, an open source WebSocket client and server for Node.js. The vulnerability impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows remote attackers to cause a confidentiality breach without requiring authentication or user interaction. A patch is available to address this issue.

CVE-2026-44728 is a high-severity security vulnerability affecting the argo-workflows package, related to the Babel JavaScript compiler. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker with local access and no privileges to execute actions requiring user interaction, potentially leading to full confidentiality, integrity, and availability compromise. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability identified as CVE-2026-41988 affects the argo-workflows package, specifically versions before 4.1.6-r1 and 4.0.15-r2. The issue relates to the uuid component before version 14. The vulnerability has a low severity score and does not impact confidentiality or availability but may cause limited integrity issues. Fixed versions 4.1.6-r1 and 4.0.15-r2 are available.

A high-severity vulnerability (CVE-2026-41907) affects the argo-workflows package related to the uuid component used for creating RFC9562 (formerly RFC4122) UUIDs. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability does not affect confidentiality or availability but allows unauthorized modification (integrity impact). A patch is available in versions 4.1.6-r1 and 4.0.15-r2.