Login Request a demo
OS
Product
Octopus Server
by Octopus Deploy · last CVE Oct 27, 2026
26
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Vulnerabilities26In the news0Timeline
Severity mix
Critical 4High 11Medium 11Low 0
Severity
All severities26Critical4High11Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Octopus Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-2572
9.8
1%
Nov 1
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still…
Affected: 3.5 before unspecified; before 2022.1.3264; 2022.2.6729 before unspecified; before 2022.2.8277; 2022.3.348 before unspecified; before 2022.3.10586; +2 more
CVE-2022-2778
9.8
1%
Sep 30
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes
Affected: 3.0 before unspecified; before 2022.2.8277; 2022.3.348 before unspecified; before 2022.3.10586; 2022.4.791 before unspecified; before 2022.4.1371
CVE-2026-0704
9.1
0%
Feb 25
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint
Affected: 2023.0.0 before 2025.3.14715; 2025.4.0 before 2025.4.10359
CVE-2022-2782
9.1
1%
Oct 26
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters
Affected: 0.9 before unspecified; before 2022.2.8351; 2022.3.348 before unspecified; before 2022.3.10586; 2022.4.791 before unspecified; before 2022.4.2898
Showing 4