https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:26:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-215145 EUVD-2026-215145 https://cve.radiocsirt.org/vuln/euvd-2026-215145 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23216 <p>Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.</p> <p>Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-23216 https://cve.radiocsirt.org/vuln/ghsa-47g2-qmh2-749v <p><strong>Affected:</strong> Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd</p> <p>### Impact</p> <p>A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository.</p> <p>The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.</p> <p>### Patches A patch for this vulnerability is available in the following Argo CD versions: - v2.13.4 - v2.12.10 - v2.11.13</p> <p>### Workarounds There is no workaround other than upgrading.</p> <p>### References Fixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 &amp; https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca</p> <p><strong>Affected:</strong> Go: github.com/argoproj/argo-cd/v2, Go: github.com/argoproj/argo-cd</p> <p>### Impact</p> <p>A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository.</p> <p>The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.</p> <p>### Patches A patch for this vulnerability is available in the following Argo CD versions: - v2.13.4 - v2.12.10 - v2.11.13</p> <p>### Workarounds There is no workaround other than upgrading.</p> <p>### References Fixed with commit https://github.com/argoproj/argo-cd/commit/6f5537bdf15ddbaa0f27a1a678632ff0743e4107 &amp; https://github.com/argoproj/gitops-engine/commit/7e21b91e9d0f64104c8a661f3f390c5e6d73ddca</p> https://cve.radiocsirt.org/vuln/ghsa-47g2-qmh2-749v https://cve.radiocsirt.org/vuln/opensuse-su-2025:14732-1 <p>govulncheck-vulndb-0.0.20250204T220613-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250204T220613-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14732-1 https://cve.radiocsirt.org/vuln/rhsa-2025:1888 <p>go-git: argument injection via the URL field go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies argocd: Argo CD does not scrub secret values from patch errors</p> <p>go-git: argument injection via the URL field go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies argocd: Argo CD does not scrub secret values from patch errors</p> https://cve.radiocsirt.org/vuln/rhsa-2025:1888 https://cve.radiocsirt.org/vuln/suse-su-2025:0429-1 <p>Security update for govulncheck-vulndb</p> <p>Security update for govulncheck-vulndb</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0429-1