CVE-2026-62185
Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other
CVSS
7.6
Alto
EPSS
0.3%
p20
KEV
—
Exploit Today
6
0-100
Publicado: 13 jul 2026 · Última mod.: 15 jul 2026 · CWE-1188
0.3%EPSS · 30 días0.3%
2026-07-142026-07-21
Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-62415——
——0The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.7hCVE-2026-600249.8 CRÍ22.4%
——7The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.21hCVE-2026-614397.5 ALT17.6%
——5PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.7dCVE-2026-548004.8 MED4.3%
——1A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.12dCVE-2026-144748.8 ALT33.7%
——10A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.17hCVE-2026-562858.6 ALT28.4%
——9Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.7d