TI-2026-36926 CVE-2026-50162 · GHSA-8xwf-rjm4-xvhv
oras-go: file store write outside workingDir via symlink traversal
Priority HIGH 70
oras-go is a Go library for managing OCI artifacts.
RHSA-2026:77269
Red Hat OpenShift GitOps v1.21.5 security update
Released 2026-10-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
Fixes 8 records
TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
TI-2026-70041 CVE-2026-55797 · GHSA-j6cw-g6p4-7hch
Command injection in Argo CD repo-server via SSH repository proxy URL
Priority MEDIUM 44
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
TI-2026-71916 CVE-2026-77459 · GHSA-fmxq-cgp8-87wp
Argo CD delete hooks bypass AppProject resource restrictions
Priority MEDIUM 43
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.
TI-2026-26189 CVE-2026-33818 · GHSA-xc2p-8ggw-6cr5
Enforce maximum recursion depth in encoding/asn1
Priority MEDIUM 40
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
TI-2026-40994 CVE-2026-56854 · GHSA-gjhq-gjfw-99mq
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Priority LOW 39
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2025-43897 CVE-2025-61560
Argo CD SessionManager race condition allows rate limit bypass and brute force
Priority LOW 37
A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.