OD
Vendor
Octopus Deploy
27
CVEs
0
On KEV
8
New 30D
Products
OS9.8
Octopus Server
Octopus Deploy
26 CVEs0 on KEV8 new
CO8.8
Codefresh
Octopus Deploy
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-12887 New | OS Octopus Server Octopus Deploy | 5.1 | Oct 27 | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent… |
| CVE-2026-117466 New | OS Octopus Server Octopus Deploy | 8.6 | Oct 27 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator |
| CVE-2026-117341 New | OS Octopus Server Octopus Deploy | 7.7 | Oct 27 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log |
| CVE-2026-116870 New | OS Octopus Server Octopus Deploy | 8.7 | Oct 27 | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently |
| CVE-2026-102488 | OS Octopus Server Octopus Deploy | 8.7 | Oct 8 | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those… |
| CVE-2026-102478 | OS Octopus Server Octopus Deploy | 8.7 | Oct 7 | In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege… |
| CVE-2026-78210 | OS Octopus Server Octopus Deploy | 7.1 | Oct 1 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization |
| CVE-2026-101169 | OS Octopus Server Octopus Deploy | 8.7 | Sep 29 | In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object |
| CVE-2026-92355 | OS Octopus Server Octopus Deploy | 8.7 | Sep 16 | In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the… |
| CVE-2026-91778 | OS Octopus Server Octopus Deploy | 7.2 | Sep 15 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker) |
| CVE-2026-12878 | CO Codefresh Octopus Deploy | 8.8 | Aug 25 | In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions |
| CVE-2026-14163 | OS Octopus Server Octopus Deploy | 7.5 | Aug 20 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text |
| CVE-2026-12702 | OS Octopus Server Octopus Deploy | 4.9 | Jul 24 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment |
| CVE-2026-8296 | OS Octopus Server Octopus Deploy | 5.6 | Jun 19 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts |
| CVE-2026-4881 | OS Octopus Server Octopus Deploy | 6.5 | Jun 4 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API… |
| CVE-2026-3237 | OS Octopus Server Octopus Deploy | 4.3 | Mar 17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via… |
| CVE-2026-3236 | OS Octopus Server Octopus Deploy | 4.3 | Mar 5 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original… |
| CVE-2026-0704 | OS Octopus Server Octopus Deploy | 9.1 | Feb 25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint |
| CVE-2022-2572 | OS Octopus Server Octopus Deploy | 9.8 | Nov 1 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still… |
| CVE-2022-2508 | OS Octopus Server Octopus Deploy | 5.3 | Oct 27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging |
| CVE-2022-2782 | OS Octopus Server Octopus Deploy | 9.1 | Oct 26 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters |
| CVE-2022-2780 | OS Octopus Server Octopus Deploy | 8.1 | Oct 14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an… |
| CVE-2022-2828 | OS Octopus Server Octopus Deploy | 6.5 | Oct 13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2022-2720 | OS Octopus Server Octopus Deploy | 5.3 | Oct 12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work |
| CVE-2022-2783 | OS Octopus Server Octopus Deploy | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
| CVE-2022-2781 | OS Octopus Server Octopus Deploy | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables |
| CVE-2022-2778 | OS Octopus Server Octopus Deploy | 9.8 | Sep 30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes |