CGA-CFW7-CQ6W-M5HJ: argo-workflows-ui-3.7
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-CFW7-CQ6W-M5HJ is a vulnerability in argo-workflows-ui-3.7 with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard120 products
- actions-runner< 2.334.0-r0
- argo-workflows-ui-3.6< 3.6.19-r6
- argo-workflows-ui-3.7< 3.7.14-r0
- argo-workflows-ui-4.0< 4.0.5-r0
- argo-workflows-ui-4.1< 4.1.2-r5
- azurite< 3.36.0-r1
- code-server< 4.112.0-r3
- dbgate< 7.1.10-r0
- dbgate-fips< 7.1.10-r0
- drupal-11.3< 11.3.13-r3
- gemini-cli< 0.41.1-r0
- homepage< 1.13.2-r0
- jitsucom-jitsu-console< 2.11.0-r23
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kibana-7< 7.17.29-r8
- kibana-8.17< 8.17.10-r19
- kibana-8.17-bitnami< 8.17.10-r19
- kibana-8.17-iamguarded< 8.17.10-r19
- kibana-8.19< 8.19.14-r5
- kibana-8.19-bitnami< 8.19.14-r6
- kibana-8.19-iamguarded< 8.19.14-r6
- kibana-9.0< 9.0.8-r23
- kibana-9.0-bitnami< 9.0.8-r23
- kibana-9.0-iamguarded< 9.0.8-r23
- kibana-9.1< 9.1.10-r15
- kibana-9.1-iamguarded< 9.1.10-r15
- kibana-9.2< 9.2.8-r2
- kibana-9.2-iamguarded< 9.2.8-r2
- kibana-9.3< 9.3.4-r3
- kibana-9.3-iamguarded< 9.3.4-r3
- kibana-9.4< 9.4.2-r1
- kibana-9.4-iamguarded< 9.4.2-r1
- kubeflow-centraldashboard< 1.10.0-r20
- kubeflow-pipelines-frontend< 2.16.0-r19
- langfuse-2< 2.95.12-r21
- langfuse-2-worker< 2.95.12-r22
- langfuse-3< 3.164.0-r8
- langfuse-3-worker< 3.164.0-r8
- langfuse-4< 4.7.1-r0
- langfuse-4-worker< 4.7.1-r0
- langfuse-fips-2< 2.95.12-r23
- langfuse-fips-2-worker< 2.95.12-r24
- langfuse-fips-3< 3.164.0-r7
- langfuse-fips-3-worker< 3.164.0-r7
- langfuse-fips-3.152< 3.152.0-r1
- langfuse-fips-4< 4.7.1-r1
- langfuse-fips-4-worker< 4.7.1-r1
- librechat< 0.8.4-r6
- nemo< 2.7.3-r20
- nextcloud-server-33< 33.0.6-r9
- nextcloud-server-34< 34.0.1-r7
- npm< 11.13.0-r1
- opensearch-dashboards-2< 2.19.5-r10
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-dashboards-maps< 2.19.5-r10
- opensearch-dashboards-2-dashboards-notifications< 2.19.5-r10
- opensearch-dashboards-2-dashboards-observability< 2.19.5-r10
- opensearch-dashboards-2-dashboards-query-workbench< 2.19.5-r10
- opensearch-dashboards-2-dashboards-reporting< 2.19.5-r10
- opensearch-dashboards-2-dashboards-search-relevance< 2.19.5-r10
- opensearch-dashboards-2-dashboards-visualizations< 2.19.5-r10
- opensearch-dashboards-2-fips< 2.19.5-r10
- opensearch-dashboards-2-fips-alerting-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-maps< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-notifications< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-observability< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-query-workbench< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-reporting< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-search-relevance< 2.19.5-r10
- opensearch-dashboards-2-fips-dashboards-visualizations< 2.19.5-r10
- opensearch-dashboards-2-fips-index-management-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-fips-ml-commons-dashboards< 2.19.5-r10
- opensearch-dashboards-2-fips-security-analytics-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-fips-security-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-index-management-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-ml-commons-dashboards< 2.19.5-r10
- opensearch-dashboards-2-security-analytics-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-2-security-dashboards-plugin< 2.19.5-r10
- opensearch-dashboards-3< 3.6.0-r2
- opensearch-dashboards-3-dashboards-maps< 3.6.0-r2
- opensearch-dashboards-3-dashboards-observability< 3.6.0-r2
- opensearch-dashboards-3-dashboards-reporting< 3.6.0-r2
- opensearch-dashboards-3-fips< 3.6.0-r3
- opensearch-dashboards-3-fips-dashboards-maps< 3.6.0-r3
- opensearch-dashboards-3-fips-dashboards-observability< 3.6.0-r3
- opensearch-dashboards-3-fips-dashboards-reporting< 3.6.0-r3
- opensearch-dashboards-3-fips-security-analytics-dashboards-plugin< 3.6.0-r3
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.6.0-r2
- prism< 5.15.9-r0
- py3.10-captum< 0.9.0-r1
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-captum< 0.9.0-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-captum< 0.9.0-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-captum< 0.9.0-r1
- py3.13-jupyterlab< 4.6.1-r1
- redisinsight< 3.4.2-r1
- renovate< 43.166.2-r0
- saf< 1.6.0-r0
- sqlpad< 7.5.7-r17
- tensorflow-cpu-jupyter< 2.21.0-r8
- wazuh-dashboard< 4.14.4-r3
- wazuh-dashboard-dashboards-maps< 4.14.4-r2
- wazuh-dashboard-dashboards-maps-fips< 4.14.4-r1
- wazuh-dashboard-dashboards-reporting< 4.14.4-r2
- wazuh-dashboard-dashboards-reporting-fips< 4.14.4-r1
- wazuh-dashboard-fips< 4.14.4-r2
- wazuh-dashboard-plugins< 4.14.4-r2
- wazuh-dashboard-plugins-fips< 4.14.4-r1
Wolfi32 products
- argo-workflows-ui-3.7< 3.7.14-r0
- argo-workflows-ui-4.0< 4.0.5-r0
- code-server< 4.112.0-r3
- jitsucom-jitsu-console< 2.11.0-r23
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kubeflow-centraldashboard< 1.10.0-r20
- kubeflow-pipelines-frontend< 2.16.0-r19
- langfuse-3< 3.164.0-r8
- langfuse-3-worker< 3.164.0-r8
- nextcloud-server-33< 33.0.6-r9
- npm< 11.13.0-r1
- opensearch-dashboards-3< 3.6.0-r2
- opensearch-dashboards-3-dashboards-maps< 3.6.0-r2
- opensearch-dashboards-3-dashboards-observability< 3.6.0-r2
- opensearch-dashboards-3-dashboards-reporting< 3.6.0-r2
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.6.0-r2
- prism< 5.15.9-r0
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-jupyterlab< 4.6.1-r1
- renovate< 43.166.2-r0
- saf< 1.6.0-r0
- sqlpad< 7.5.7-r17
2 vendors · 152 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2026-84008chainguardactions-runner+400.77%Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-70162chainguardactions-runner+280.77%A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application.
The update addresses the vulnerability by correcting how the .NET web application handles web requests.CVE-2021-23337chainguardairflow-2+23021.33%The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.CVE-2025-13465chainguardairflow-2+2561.82%The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.CVE-2025-62157chainguardargo-workflow-cli-3.6+680.47%Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.CVE-2025-62156chainguardargo-workflow-cli-3.6+680.59%Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue.