GO-2023-1520: JWT audience claim is not verified in github.com/argoproj/argo-cd

  GO-2023-1577: Users with any cluster secret update access may update out-of-bounds cluster secrets in github.com/argoproj/argo-cd

  GO-2023-1670: Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd

  GO-2023-2049: Argo CD cluster secret might leak in cluster details page in github.com/argoproj/argo-cd

  GO-2024-2646: Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v2

  GO-2024-2792: Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd

  GO-2024-2877: ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd

  GO-2024-2898: Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd

  GO-2024-3002: Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd

  GO-2025-3433: Argo CD does not scrub secret values from patch errors in github.com/argoproj/argo-cd

  GO-2025-3720: Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

  GO-2025-3993: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd

  GO-2025-3994: Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd

  GO-2025-3996: argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd