github.com/argoproj/argo-cd/v2 vulnerabilities

CVEs whose affected-version data names the github.com/argoproj/argo-cd/v2 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

github.com/argoproj/argo-cd/v2 vulnerabilities

Argo CD allows cross-site scripting on repositories page

Argo CD does not scrub secret values from patch errors

The Argo CD web terminal session does not handle the revocation of user permissions properly

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

Argo CD's API server does not enforce project sourceNamespaces

ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability

Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

Bypassing Rate Limit and Brute Force Protection Using Cache Overflow

Cross-site scripting on application summary component

Users with `create` but not `override` privileges can perform local sync

github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD authenticated but unauthorized users may enumerate Application names via the API

Controller reconciles apps outside configured namespaces when sharding is enabled

Path traversal and dereference of symlinks in Argo CD

Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2