CGA-W9W3-8PQX-4PHP: argo-workflows-ui-3.7
Unknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-W9W3-8PQX-4PHP is a vulnerability in argo-workflows-ui-3.7 with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Chainguard121 products
- arangodb-3.11< 3.11.14.4-r8
- argo-workflows-ui-3.6< 3.6.19-r7
- argo-workflows-ui-3.7< 3.7.15-r1
- argo-workflows-ui-4.0< 4.0.6-r1
- dbgate< 7.2.0-r1
- drupal-11.3< 11.3.13-r3
- gemini-cli< 0.47.0-r0
- gitlab-rails-ce-18.11< 18.11.6-r7
- gitlab-rails-ce-19.3< 19.3.1-r6
- gitlab-rails-ce-fips-18.11< 18.11.6-r7
- gitlab-rails-ce-fips-19.3< 19.3.1-r3
- jitsucom-jitsu-console< 2.11.0-r27
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kibana-8.17< 8.17.10-r26
- kibana-8.17-bitnami< 8.17.10-r26
- kibana-8.17-iamguarded< 8.17.10-r26
- kibana-8.19< 8.19.17-r1
- kibana-8.19-bitnami< 8.19.17-r1
- kibana-8.19-iamguarded< 8.19.17-r1
- kibana-9.0< 9.0.8-r31
- kibana-9.0-bitnami< 9.0.8-r31
- kibana-9.0-iamguarded< 9.0.8-r31
- kibana-9.1< 9.1.10-r23
- kibana-9.1-iamguarded< 9.1.10-r23
- kibana-9.2< 9.2.8-r11
- kibana-9.2-iamguarded< 9.2.8-r11
- kibana-9.3< 9.3.6-r1
- kibana-9.3-iamguarded< 9.3.6-r1
- kibana-9.4< 9.4.2-r6
- kibana-9.4-iamguarded< 9.4.2-r6
- kubeflow-centraldashboard< 1.10.0-r24
- kubeflow-pipelines-frontend< 2.16.1-r9
- langfuse-3< 3.188.0-r0
- langfuse-3-worker< 3.188.0-r0
- langfuse-fips-3< 3.188.0-r0
- langfuse-fips-3-worker< 3.188.0-r0
- lerna< 9.0.7-r9
- librechat< 0.8.6-r4
- nextcloud-server-31< 31.0.14-r5
- nextcloud-server-32< 32.0.12-r2
- nextcloud-server-33< 33.0.6-r3
- nextcloud-server-34< 34.0.1-r2
- opensearch-dashboards-2< 2.19.5-r15
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.5-r15
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.5-r15
- opensearch-dashboards-2-dashboards-maps< 2.19.5-r15
- opensearch-dashboards-2-dashboards-notifications< 2.19.5-r15
- opensearch-dashboards-2-dashboards-observability< 2.19.5-r15
- opensearch-dashboards-2-dashboards-query-workbench< 2.19.5-r15
- opensearch-dashboards-2-dashboards-reporting< 2.19.5-r15
- opensearch-dashboards-2-dashboards-search-relevance< 2.19.5-r15
- opensearch-dashboards-2-dashboards-visualizations< 2.19.5-r15
- opensearch-dashboards-2-fips< 2.19.5-r16
- opensearch-dashboards-2-fips-alerting-dashboards-plugin< 2.19.5-r16
- opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-maps< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-notifications< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-observability< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-query-workbench< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-reporting< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-search-relevance< 2.19.5-r16
- opensearch-dashboards-2-fips-dashboards-visualizations< 2.19.5-r16
- opensearch-dashboards-2-fips-index-management-dashboards-plugin< 2.19.5-r16
- opensearch-dashboards-2-fips-ml-commons-dashboards< 2.19.5-r16
- opensearch-dashboards-2-fips-security-analytics-dashboards-plugin< 2.19.5-r16
- opensearch-dashboards-2-fips-security-dashboards-plugin< 2.19.5-r16
- opensearch-dashboards-2-index-management-dashboards-plugin< 2.19.5-r15
- opensearch-dashboards-2-ml-commons-dashboards< 2.19.5-r15
- opensearch-dashboards-2-security-analytics-dashboards-plugin< 2.19.5-r15
- opensearch-dashboards-2-security-dashboards-plugin< 2.19.5-r15
- opensearch-dashboards-3< 3.7.0-r2
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.7.0-r2
- opensearch-dashboards-3-dashboards-maps< 3.7.0-r0
- opensearch-dashboards-3-dashboards-notifications< 3.7.0-r0
- opensearch-dashboards-3-dashboards-observability< 3.7.0-r0
- opensearch-dashboards-3-dashboards-query-workbench< 3.7.0-r0
- opensearch-dashboards-3-dashboards-reporting< 3.7.0-r2
- opensearch-dashboards-3-dashboards-search-relevance< 3.7.0-r0
- opensearch-dashboards-3-fips< 3.7.0-r1
- opensearch-dashboards-3-fips-alerting-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin< 3.7.0-r1
- opensearch-dashboards-3-fips-dashboards-maps< 3.7.0-r0
- opensearch-dashboards-3-fips-dashboards-notifications< 3.7.0-r0
- opensearch-dashboards-3-fips-dashboards-observability< 3.7.0-r0
- opensearch-dashboards-3-fips-dashboards-query-workbench< 3.7.0-r0
- opensearch-dashboards-3-fips-dashboards-reporting< 3.7.0-r1
- opensearch-dashboards-3-fips-dashboards-search-relevance< 3.7.0-r0
- opensearch-dashboards-3-fips-index-management-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-fips-ml-commons-dashboards< 3.7.0-r0
- opensearch-dashboards-3-fips-security-analytics-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-fips-security-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-index-management-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-ml-commons-dashboards< 3.7.0-r0
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-security-dashboards-plugin< 3.7.0-r0
- pelias-api< 7.8.0-r4
- prism< 5.15.11-r3
- py3.10-captum< 0.9.0-r1
- py3.11-captum< 0.9.0-r1
- py3.12-captum< 0.9.0-r1
- py3.13-captum< 0.9.0-r1
- redisinsight< 3.6.0-r1
- saf< 1.6.0-r1
- semaphore< 2.18.12-r1
- sqlpad< 7.5.7-r26
- tileserver-gl< 5.6.0-r6
- tileserver-gl-fips< 5.6.0-r5
- unleash< 8.0.1-r0
- wazuh-dashboard-dashboards-reporting< 4.14.5-r7
- wazuh-dashboard-dashboards-reporting-fips< 4.14.5-r7
- wazuh-dashboard-plugins< 4.14.5-r7
- wazuh-dashboard-plugins-fips< 4.14.5-r7
Wolfi36 products
- argo-workflows-ui-3.7< 3.7.15-r1
- argo-workflows-ui-4.0< 4.0.6-r1
- jitsucom-jitsu-console< 2.11.0-r27
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kubeflow-centraldashboard< 1.10.0-r24
- kubeflow-pipelines-frontend< 2.16.1-r9
- langfuse-3< 3.188.0-r0
- langfuse-3-worker< 3.188.0-r0
- lerna< 9.0.7-r9
- nextcloud-server-32< 32.0.12-r2
- nextcloud-server-33< 33.0.6-r3
- opensearch-dashboards-3< 3.7.0-r2
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.7.0-r2
- opensearch-dashboards-3-dashboards-maps< 3.7.0-r0
- opensearch-dashboards-3-dashboards-notifications< 3.7.0-r0
- opensearch-dashboards-3-dashboards-observability< 3.7.0-r0
- opensearch-dashboards-3-dashboards-query-workbench< 3.7.0-r0
- opensearch-dashboards-3-dashboards-reporting< 3.7.0-r2
- opensearch-dashboards-3-dashboards-search-relevance< 3.7.0-r0
- opensearch-dashboards-3-index-management-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-ml-commons-dashboards< 3.7.0-r0
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.7.0-r0
- opensearch-dashboards-3-security-dashboards-plugin< 3.7.0-r0
- prism< 5.15.11-r3
- saf< 1.6.0-r1
- sqlpad< 7.5.7-r26
- tileserver-gl< 5.6.0-r6
2 vendors · 157 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
RoutineCVE-2026-118764isaacs · minimatch +157 moreminimatch: potential denial of service via globparts amplificationminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.CVSS6.9MediumEPSS0.29%RoutineCVE-2026-115754yahoo · serialize-javascript +45 moreSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodySerialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This issue is fixed in version 7.1.3.CVSS2.1LowEPSS0.23%PrioritiseCVE-2026-111181body-parser +52 morebody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.CVSS7.5HighEPSS0.39%RoutineCVE-2026-97711yahoo · serialize-javascript +7 moreSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesSerialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and options.isJSON output are unaffected. This issue is fixed in version 7.1.2.CVSS2.3LowEPSS0.32%PrioritiseCVE-2026-93687micromatch · braces +112 morebraces through 3.0.3 Stack Overflow via Deeply Nested Patternsbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.CVSS8.7HighEPSS0.76%RoutineCVE-2026-85062omgovich · colord +34 moreColord: Slow rejection of oversized malformed color stringsColord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.CVSS6.9MediumEPSS0.51%