Gocd vulnerabilities

Products

• Gocd 27

Newest

• gocd GoCD is vulnerable to authorization bypass via pipeline structure API CVE-2026-55632 4.3 MediumSeptember 23, 2026
• gocd GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API CVE-2026-52744 5.3 MediumSeptember 23, 2026
• gocd GoCD is vulnerable to historical server configuration API authorization bypass CVE-2026-52742 5.1 MediumSeptember 21, 2026
• gocd GoCD is vulnerable to credential exposure when admins insecurely configure material URLs CVE-2026-55870 2.3 LowSeptember 21, 2026
• gocd GoCD is vulnerable to authorization bypass via material connection test APIs CVE-2026-55625 4.9 MediumSeptember 21, 2026
• gocd GoCD is vulnerable to pipeline template view API authorization bypass CVE-2026-52740 5.3 MediumSeptember 21, 2026
• gocd GoCD is vulnerable to authorization bypass via support process list API CVE-2026-55060 3.7 LowSeptember 21, 2026
• gocd GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages CVE-2026-52741 7.5 HighSeptember 21, 2026
• gocd GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages CVE-2026-68919 7.0 HighSeptember 21, 2026
• gocd GoCD before 26.1.0 is vulnerable to authorization bypass via job status API CVE-2026-52743 4.3 MediumSeptember 21, 2026
• gocd GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins CVE-2024-56324 2.1 LowJanuary 3, 2025
• gocd GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality CVE-2024-56322 2.1 LowJanuary 3, 2025
• gocd GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access CVE-2024-56321 3.8 LowJanuary 3, 2025
• gocd GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVE-2024-56320 9.4 CriticalJanuary 3, 2025
• gocd GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up CVE-2024-28866 3.1 LowMay 13, 2024
• gocd Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd CVE-2023-28629 5.4 MediumMarch 27, 2023
• gocd Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd CVE-2023-28630 4.2 MediumMarch 27, 2023
• gocd Compromised agents may be able to execute remote code on GoCD Server CVE-2022-39311 9.1 CriticalOctober 14, 2022
• gocd Malicious agent may be able to impersonate another agent in GoCD CVE-2022-39310 4.9 MediumOctober 14, 2022
• gocd GoCD server secret encryption/decryption key leaked to agents during material serialization CVE-2022-39309 4.9 MediumOctober 14, 2022
• gocd GoCD API authentication of user access tokens subject to timing attack during comparison CVE-2022-39308 6.5 MediumOctober 14, 2022
• gocd GoCD Windows installations outside default location inadequately restrict installation file permissions CVE-2022-36088 5.0 MediumSeptember 7, 2022
• gocd Command Injection/Argument Injection in GoCD CVE-2022-29184 8.8 HighMay 20, 2022
• gocd Reflected XSS in GoCD CVE-2022-29183 4.3 MediumMay 20, 2022
• gocd DOM-based XSS in GoCD CVE-2022-29182 4.3 MediumMay 20, 2022
• gocd Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames CVE-2022-24832 8.2 HighApril 11, 2022
• gocd In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing... CVE-2021-25924 8.8 HighApril 1, 2021