A
Vendor security profile
argoproj
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs23
Critical4
CISA KEV0
Public exploit17
Patch rate%61
Avg. CVSS7.9
12-month vulnerability rate
0
0
1
0
2
1
6
0
4
1
1
2
CVE KEV
CVE severity distribution
23toplam CVE
Critical4 (17%)
High14 (61%)
Medium5 (22%)
Patch and exploitation view
%61
Verified patch
%0
CISA KEV
%74
Public exploit
14Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
9.9
CVE-2026-77459
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
A
Patch status unknown
5.3
CVE-2026-108585
argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
A
Patch status unknownEPSS %0
8.8
CVE-2026-55797
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
A
Patch status unknownEPSS %2
8.3
CVE-2026-93991
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
A
Patch verifiedEPSS %0
10.0
CVE-2026-82456
argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
A
Patch status unknownEPSS %2
9.3
CVE-2026-82277
Argo Rollouts Dashboard Unauthenticated Mutating Operations
A
Patch status unknownEPSS %1
9.9
CVE-2026-54526
Improper access control in Argoproj Argo Workflows
A
Patch verifiedEPSS %1
8.7
CVE-2026-45738
Cross-site scripting in Argoproj Argo Cd
A
Patch verifiedEPSS %1
6.5
CVE-2026-45737
Information exposure in Argoproj Argo Cd
A
Patch verifiedEPSS %1
8.9
CVE-2026-15416
Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
A
Patch status unknownEPSS %0