AR
Product
argo-cd
63
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 12High 22Medium 29Low 0
Watch
Add argo-cd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-23216 | 6.8 | Jan 30 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: before 2.11.13; 2.12.0 before 2.12.10; 2.13.0 before 2.13.4 |
| CVE-2026-45737 | 6.5 | Jul 15 | Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations Affected: >= 3.2.0, < 3.2.12; >= 3.3.9, < 3.3.10; >= 3.4.1, < 3.4.2 |
| CVE-2024-41666 | 6.5 | Jul 24 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.6.0 before 2.9.21; 2.10.0 before 2.10.16; 2.11.0 before 2.11.7 |
| CVE-2024-32476 | 6.5 | May 14 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.1.0 before 2.8.17; 2.9.0 before 2.9.13; 2.10.0 before 2.10.8 |
| CVE-2024-29893 | 6.5 | Mar 29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.4.0 before 2.8.14; 2.9.0 before 2.9.10; 2.10.0 before 2.10.5 |
| CVE-2023-40584 | 6.5 | Sep 7 | Argo CD is a declarative continuous deployment for Kubernetes Affected: 2.4.0 before 2.6.15; 2.7.0 before 2.7.14; 2.8.0 before 2.8.3 |
| CVE-2023-25163 | 6.5 | Feb 8 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; 2.6.0; +2 more |
| CVE-2022-31016 | 6.5 | Jun 25 | Argo CD is a declarative continuous deployment for Kubernetes Affected: 0.7.0 before 2.1.16; 2.2.0 before 2.2.10; 2.3.0 before 2.3.5; 2.4.0 before 2.4.1 |
| CVE-2022-24730 | 6.5 | Mar 23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.3.0 before 2.1.11; 2.2.0 before 2.2.6; 2.3.0; 2.3.0; 2.3.0; 2.3.0 |
| CVE-2021-3557 | 6.5 | Feb 16 | A flaw was found in argocd Affected: before 1.1.1 |
| CVE-2021-26921 | 6.5 | Feb 9 | In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled Affected: before 1.7.12; 1.8.0 before 1.8.4 |
| CVE-2018-21034 | 6.5 | Apr 9 | In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git Affected: through 1.4.2 |
| CVE-2023-50726 | 6.4 | Mar 13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.2.0 before 2.8.12; 2.9.0 before 2.9.7; 2.10.0 before 2.10.3 |
| CVE-2024-31990 | 6.3 | Apr 15 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.4.0 before 2.8.16; 2.9.0 before 2.9.12; 2.10.0 before 2.10.7 |
| CVE-2022-31102 | 6.1 | Jul 12 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 2.3.0 before 2.3.6; 2.4.0 before 2.4.5 |
| CVE-2021-26924 | 6.1 | Mar 15 | An issue was discovered in Argo CD before 1.8.4 Affected: before 1.7.12; 1.8.0 before 1.8.4 |
| CVE-2021-23135 | 5.5 | May 12 | Exposure of System Data to an Unauthorized Control Sphere vulnerability in web UI of Argo CD allows attacker to cause leaked secret data into web UI error messages and logs Affected: 1.7.0 before 1.7.14; 1.8.0 before 1.8.7 |
| CVE-2025-47933 | 5.4 | May 29 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.2.1 before 2.13.8; 2.14.0 before 2.14.13; 3.0.0 before 3.0.4; 1.2.0; 1.2.0 |
| CVE-2024-28175 | 5.4 | Mar 13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.0.0 before 2.8.12; 2.9.0 before 2.9.8; 2.10.0 before 2.10.3 |
| CVE-2022-31035 | 5.4 | Jun 27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.0.0 before 2.1.16; 2.2.9; 2.3.4; 2.4.0 |
| CVE-2025-55191 | 5.3 | Sep 30 | Repository Credentials Race Condition Crashes Argo CD Server Affected: >= 2.1.0, < 2.14.20; = 3.2.0-rc1; >= 3.1.0-rc1, < 3.1.8; >= 3.0.0-rc1, < 3.0.19 |
| CVE-2020-11576 | 5.3 | Apr 8 | Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because… Affected: 1.5.0 |
| CVE-2022-24731 | 4.9 | Mar 23 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.5.0 before 2.1.11; 2.2.0 before 2.2.6; 2.3.0; 2.3.0; 2.3.0; 2.3.0 |
| CVE-2021-23347 | 4.8 | Mar 3 | The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would… Affected: before 1.7.13; 1.8.0 before 1.8.6 |
| CVE-2024-36106 | 4.3 | Jun 6 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: after 0.11.0 before 2.9.17; 2.10.0 before 2.10.12; 2.11.0 before 2.11.3 |
| CVE-2023-40026 | 4.3 | Sep 27 | Argo CD is a declarative continuous deployment framework for Kubernetes Affected: before 2.3.0 |
| CVE-2022-31036 | 4.3 | Jun 27 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 1.3.0 before 2.1.6; 2.2.9; 2.3.4; 2.4.0 |
| CVE-2022-24905 | 4.3 | May 20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 0.6.1 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4 |
| CVE-2022-24904 | 4.3 | May 20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes Affected: 0.7.0 before 2.1.15; 2.2.0 before 2.2.9; 2.3.0 before 2.3.4 |
Showing 29