# Argoproj Argo Cd


- [CVE-2025-55190](https://insights.sbomify.com/CVE-2025-55190/): Argo CD: Project API Token Exposes Repository Credentials (critical 10.0)
- [CVE-2022-29165](https://insights.sbomify.com/CVE-2022-29165/): Argo CD will blindly trust JWT claims if anonymous access is enabled (critical 10.0)
- [CVE-2023-40029](https://insights.sbomify.com/CVE-2023-40029/): Cluster secret might leak in cluster details page in Argo CD (critical 9.9)
- [CVE-2022-24768](https://insights.sbomify.com/CVE-2022-24768/): Improper access control allows admin privilege escalation in Argo CD (critical 9.9)
- [CVE-2024-21652](https://insights.sbomify.com/CVE-2024-21652/): Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss (critical 9.8)
- [CVE-2026-42880](https://insights.sbomify.com/CVE-2026-42880/): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction (critical 9.6)
- [CVE-2025-47933](https://insights.sbomify.com/CVE-2025-47933/): Argo CD allows cross-site scripting on repositories page (critical 9.1)
- [CVE-2024-31989](https://insights.sbomify.com/CVE-2024-31989/): ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache (critical 9.1)
- [CVE-2024-28175](https://insights.sbomify.com/CVE-2024-28175/): Cross-site scripting on application summary component in argo-cd (critical 9.1)
- [CVE-2023-23947](https://insights.sbomify.com/CVE-2023-23947/): Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets (critical 9.1)
- [CVE-2023-22482](https://insights.sbomify.com/CVE-2023-22482/): JWT audience claim is not verified (critical 9.1)
- [CVE-2022-31035](https://insights.sbomify.com/CVE-2022-31035/): External URLs for Deployments can include javascript in argo-cd (critical 9.0)

---
From sbomify Insights: https://insights.sbomify.com/products/argoproj/argo-cd/