In Argo CD versions from 2.10.0 prior to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 a critical severity vulnerability CVE-2026-77459 was detected. This vulnerability allows an attacker with write access to an Application’s Git repository to bypass destination and resource authorization checks, potentially creating unauthorized resources within the Kubernetes cluster. This occurs because Argo CD creates PostDelete resource hooks without applying the standard AppProject allow/deny lists used during normal synchronization. By committing a maliciously crafted delete hook targeting a forbidden namespace, server, group, or kind, the attacker can force the application-controller to create that resource using its destination-cluster credentials when the Application is deleted. While the impact is bounded by the controller’s own access rights, it can lead to the compromise of cluster-scoped resources and disallowed namespaces. To address this issue, users should upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, 3.6.0-rc2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-77459.
In Appwrite versions up to 2.3.0 a medium severity vulnerability CVE-2026-108770 was detected. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) attacks, potentially gaining unauthorized access to internal network resources or services. This occurs due to a flaw in the PublicHostname function within the src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php file of the Browser Screenshot Service component. By manipulating the url argument, an attacker can trick the server into making unintended outbound HTTP requests on their behalf. To address this issue, users should upgrade Appwrite to version 2.4.0 or later, or apply the official patch (commit 393255e7302ae5503331d45802e2eee01c6a47fe). For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-108770.
In Django versions from 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7 a low severity vulnerability CVE-2025-59682 was detected. This vulnerability allows for partial directory traversal, potentially leading to unauthorized file writes outside the intended target directory. This occurs due to a flaw in the django.utils.archive.extract() function, which is utilized when developers run the startapp --template and startproject --template management commands. If a developer uses a maliciously crafted archive where file paths share a common prefix with the target directory, the extraction process can escape the intended extraction path. To address this issue, users should upgrade Django to versions 4.2.25, 5.1.13, 5.2.7, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59682.
In Argo Workflows versions prior to 3.6.12, and from 3.7.0 before 3.7.3 a high severity vulnerability CVE-2025-62157 was detected. This vulnerability allows an attacker with permissions to read pod logs in the Argo Workflows namespace to obtain plaintext credentials to the artifact repository, potentially leading to unauthorized access and data compromise. This occurs because the workflow-controller improperly exposes sensitive artifact repository credentials in plaintext within its pod logs. By inspecting these logs, an attacker can extract the exposed secrets. There are no known workarounds for this issue. To address this vulnerability, users must upgrade Argo Workflows to versions 3.6.12, 3.7.3, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62157.
In Budibase versions prior to 3.41.3 a high severity vulnerability CVE-2026-82240 was detected. This vulnerability allows an authenticated app-scoped builder to escalate their privileges and gain unauthorized builder access to unrelated applications within the same tenant. This occurs due to inadequate validation of app-scoped builder role assignments in the public user create and update API endpoints. By submitting a specially crafted request containing manipulated builder.apps fields to the user update API, an attacker can bypass intended access controls and improperly grant builder rights to other applications. To address this issue, users should upgrade Budibase to version 3.41.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-82240.
In Teradata provider component for Apache Airflow versions earlier than 3.7.0 a medium severity vulnerability CVE-2026-81862 was detected. This vulnerability allows an attacker to potentially expose sensitive cloud storage credentials. To address this issue, users should upgrade Teradata provider to version 3.7.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-81862.
Read more Data Analytics