OS
Product
Octopus Server
66
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 19Medium 37Low 4
Watch
Add Octopus Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-9194 | 9.8 | Sep 30 | SQL Injection in the Octopus Server REST API Affected: 2024.1.437 before 2024.1.13038; 2024.2.101 before 2024.2.9482; 2024.3.164 before 2024.3.12766 |
| CVE-2022-2572 | 9.8 | Nov 1 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still… Affected: 3.5 before 2022.1.3264; 2022.2.6729 before 2022.2.8277; 2022.3.348 before 2022.3.10586; 2022.4.791 before 2022.4.2898 |
| CVE-2022-2778 | 9.8 | Sep 30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes Affected: 3.0 before 2022.2.8277; 2022.3.348 before 2022.3.10405; 2022.4.791 before 2022.4.1371 |
| CVE-2018-11320 | 9.8 | May 21 | In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs Affected: 2018.4.4 through 2018.5.1 |
| CVE-2026-0704 | 9.1 | Feb 25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint Affected: 2023.1.4189 before 2025.3.14715 |
| CVE-2022-2782 | 9.1 | Oct 26 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters Affected: before 2022.2.8351; 2022.3.0 before 2022.3.10586; 2022.4.0 before 2022.4.2898 |
Showing 6