CGA-738G-G4GP-HQW4: argo-workflows-ui-3.7
Unknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-738G-G4GP-HQW4 is a vulnerability in argo-workflows-ui-3.7 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Chainguard115 products
- arangodb-3.11< 3.11.14.3-r5
- arangodb-3.12< 3.12.7.2-r5
- argo-workflows-ui-3.6< 3.6.19-r5
- argo-workflows-ui-3.7< 3.7.13-r0
- argo-workflows-ui-4.0< 4.0.4-r0
- code-server< 4.112.0-r2
- drupal-11.3< 11.3.13-r3
- foxx-cli< 2.1.1-r6
- gitlab-rails-ce-19.0< 19.0.3-r1
- gitlab-rails-ce-fips-19.1< 19.1.1-r1
- jitsucom-jitsu-console< 2.11.0-r19
- json-server< 0.17.4-r6
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kibana-8.17< 8.17.10-r17
- kibana-8.17-bitnami< 8.17.10-r17
- kibana-8.17-iamguarded< 8.17.10-r17
- kibana-8.19< 8.19.14-r2
- kibana-8.19-bitnami< 8.19.14-r2
- kibana-8.19-iamguarded< 8.19.14-r2
- kibana-9.0< 9.0.8-r19
- kibana-9.0-bitnami< 9.0.8-r19
- kibana-9.0-iamguarded< 9.0.8-r19
- kibana-9.1< 9.1.10-r12
- kibana-9.1-iamguarded< 9.1.10-r12
- kibana-9.2< 9.2.7-r5
- kibana-9.2-iamguarded< 9.2.7-r5
- kibana-9.3< 9.3.3-r4
- kibana-9.3-iamguarded< 9.3.3-r4
- kibana-9.4< 9.4.2-r0
- kibana-9.4-iamguarded< 9.4.2-r0
- kubeflow-centraldashboard< 1.10.0-r18
- kubeflow-pipelines-frontend< 2.16.0-r11
- langfuse-2< 2.95.12-r17
- langfuse-2-worker< 2.95.12-r17
- langfuse-3< 3.164.0-r1
- langfuse-3-worker< 3.164.0-r1
- langfuse-fips-2< 2.95.12-r20
- langfuse-fips-2-worker< 2.95.12-r20
- langfuse-fips-3< 3.164.0-r1
- langfuse-fips-3-worker< 3.164.0-r1
- librechat< 0.8.4-r5
- npm< 11.12.1-r3
- opensearch-dashboards-2< 2.19.5-r8
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.5-r8
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.5-r8
- opensearch-dashboards-2-dashboards-maps< 2.19.5-r8
- opensearch-dashboards-2-dashboards-notifications< 2.19.5-r8
- opensearch-dashboards-2-dashboards-observability< 2.19.5-r8
- opensearch-dashboards-2-dashboards-query-workbench< 2.19.5-r8
- opensearch-dashboards-2-dashboards-reporting< 2.19.5-r8
- opensearch-dashboards-2-dashboards-search-relevance< 2.19.5-r8
- opensearch-dashboards-2-dashboards-visualizations< 2.19.5-r8
- opensearch-dashboards-2-fips< 2.19.5-r7
- opensearch-dashboards-2-fips-alerting-dashboards-plugin< 2.19.5-r7
- opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-maps< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-notifications< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-observability< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-query-workbench< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-reporting< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-search-relevance< 2.19.5-r7
- opensearch-dashboards-2-fips-dashboards-visualizations< 2.19.5-r7
- opensearch-dashboards-2-fips-index-management-dashboards-plugin< 2.19.5-r7
- opensearch-dashboards-2-fips-ml-commons-dashboards< 2.19.5-r7
- opensearch-dashboards-2-fips-security-analytics-dashboards-plugin< 2.19.5-r7
- opensearch-dashboards-2-fips-security-dashboards-plugin< 2.19.5-r7
- opensearch-dashboards-2-index-management-dashboards-plugin< 2.19.5-r8
- opensearch-dashboards-2-ml-commons-dashboards< 2.19.5-r8
- opensearch-dashboards-2-security-analytics-dashboards-plugin< 2.19.5-r8
- opensearch-dashboards-2-security-dashboards-plugin< 2.19.5-r8
- opensearch-dashboards-3< 3.5.0-r12
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.5.0-r15
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.5.0-r15
- opensearch-dashboards-3-dashboards-observability< 3.5.0-r15
- opensearch-dashboards-3-fips< 3.5.0-r9
- opensearch-dashboards-3-fips-alerting-dashboards-plugin< 3.5.0-r9
- opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin< 3.5.0-r9
- opensearch-dashboards-3-fips-dashboards-observability< 3.5.0-r9
- opensearch-dashboards-3-fips-security-analytics-dashboards-plugin< 3.5.0-r9
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.5.0-r15
- pelias-api< 7.6.0-r6
- prism< 5.15.6-r2
- py3.10-captum< 0.9.0-r1
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-captum< 0.9.0-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-captum< 0.9.0-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-captum< 0.9.0-r1
- py3.13-jupyterlab< 4.6.1-r1
- redisinsight< 3.2.0-r5
- renovate< 43.104.7-r1
- saf< 1.6.0-r0
- semaphore< 2.18.12-r2
- sqlpad< 7.5.7-r17
- tensorflow-cpu-jupyter< 2.21.0-r8
- tensorflow-gpu-jupyterAll versions (No fix recorded)
- ts-patch< 4.0.1-r3
- vitess-22< 22.0.4-r9
- vitess-23< 23.0.3-r12
- wazuh-dashboard< 4.14.4-r1
- wazuh-dashboard-alerting-dashboards-plugin< 4.14.4-r1
- wazuh-dashboard-anomaly-detection-dashboards-plugin< 4.14.4-r1
- wazuh-dashboard-dashboards-reporting-fips< 4.14.7-r8
- wazuh-dashboard-index-management-dashboards-plugin-fips< 4.14.7-r8
- wazuh-dashboard-plugins< 4.14.4-r1
- wazuh-dashboard-security-plugin-fips< 4.14.7-r8
Wolfi34 products
- argo-workflows-ui-3.7< 3.7.13-r0
- argo-workflows-ui-4.0< 4.0.4-r0
- code-server< 4.112.0-r2
- jitsucom-jitsu-console< 2.11.0-r19
- json-server< 0.17.4-r6
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kubeflow-centraldashboard< 1.10.0-r18
- kubeflow-pipelines-frontend< 2.16.0-r11
- langfuse-3< 3.164.0-r1
- langfuse-3-worker< 3.164.0-r1
- npm< 11.12.1-r3
- opensearch-dashboards-3< 3.5.0-r12
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.5.0-r15
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.5.0-r15
- opensearch-dashboards-3-dashboards-observability< 3.5.0-r15
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.5.0-r15
- prism< 5.15.6-r2
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-jupyterlab< 4.6.1-r1
- renovate< 43.104.7-r1
- saf< 1.6.0-r0
- sqlpad< 7.5.7-r17
- ts-patch< 4.0.1-r3
- vitess-23< 23.0.3-r12
2 vendors · 149 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
PrioritiseCVE-2026-102422chainguard · arangodb-3.12 +29 moreshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokenshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.CVSS9.2CriticalEPSS0.38%PrioritiseCVE-2026-102278juliangruber · brace-expansion +156 morebrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.CVSS7.5HighEPSS0.49%RoutineCVE-2026-102277juliangruber · brace-expansion +129 morebrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.CVSS5.3MediumEPSS0.43%PrioritiseCVE-2026-102276juliangruber · brace-expansion +130 morebrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.CVSS7.5HighEPSS0.46%PrioritiseCVE-2026-90711proxy-addr +70 moreproxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetproxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.CVSS9.1CriticalEPSS0.26%RoutineCVE-2026-17495moment +54 moremoment vulnerable to Path Traversal via crafted non-string locale namemoment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().CVSS5.9MediumEPSS0.52%