Octopus Deploy vulnerabilities

Products

• Server 74
• Tentacle 4

Newest

• octopus deploy server In affected versions of Octopus Server with the LDAP authentication provider enabled, any... CVE-2026-118426 5.3 MediumOctober 29, 2026
• octopus deploy server In affected versions of Octopus Server, a user with permission to upload a malicious nuget... CVE-2026-12887 5.1 MediumOctober 27, 2026
• octopus deploy server In affected versions of Octopus Server, a user holding the System Manager role could escalate... CVE-2026-117466 8.6 HighOctober 27, 2026
• octopus deploy server In affected versions of Octopus Server, creating a user invitation writes the invitation code to... CVE-2026-117341 7.7 HighOctober 27, 2026
• octopus deploy server In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently... CVE-2026-116870 8.7 HighOctober 27, 2026
• octopus deploy server In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments... CVE-2026-102488 8.7 HighOctober 8, 2026
• octopus deploy server In affected versions of Octopus Server, an authenticated user with permission to modify roles... CVE-2026-102478 8.7 HighOctober 7, 2026
• octopus deploy server In affected versions of Octopus Server, users with certain scoped permission sets could execute... CVE-2026-78210 7.1 HighOctober 1, 2026
• octopus deploy server In affected versions of Octopus Server, an authenticated user with permissions to edit an... CVE-2026-101169 8.7 HighSeptember 29, 2026
• octopus deploy server In affected versions of Octopus Server, a user with permission to modify non built-in external... CVE-2026-92355 8.7 HighSeptember 16, 2026
• octopus deploy server In affected versions of Octopus Server, users with certain scoped permission sets could execute... CVE-2026-91778 7.2 HighSeptember 15, 2026
• octopus codefresh In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint... CVE-2026-12878 8.6 HighAugust 25, 2026
• octopus server In affected versions of Octopus Server under certain circumstances it is possible for sensitive... CVE-2026-14163 7.1 HighAugust 20, 2026
• octopus server In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows... CVE-2026-12702 5.1 MediumJuly 24, 2026
• octopus deploy server In affected versions of Octopus Server with certain access levels it was possible to embed a... CVE-2026-8296 5.6 MediumJune 19, 2026
• octopus server In affected versions of Octopus Server, permissions were not checked correctly resulting in any... CVE-2026-4881 6.0 MediumJune 4, 2026
• octopus server In affected versions of Octopus Server it was possible for a low privileged user to manipulate an... CVE-2026-3237 2.3 LowMarch 17, 2026
• octopus server In affected versions of Octopus Server it was possible to create a new API key from an existing... CVE-2026-3236 2.3 LowMarch 5, 2026
• octopus server In affected version of Octopus Deploy it was possible to remove files and/or contents of files on... CVE-2026-0704 5.9 MediumFebruary 25, 2026
• octopus server In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending... CVE-2025-0539 5.9 MediumApril 10, 2025
• octopus server In affected versions of Octopus Server it was possible for a user with sufficient access to set... CVE-2025-0588 5.9 MediumFebruary 11, 2025
• octopus server In affected versions of Octopus Server error messages were handled unsafely on the error page. If... CVE-2025-0513 1.8 LowFebruary 11, 2025
• octopus server In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on... CVE-2025-0526 2.3 LowFebruary 11, 2025
• octopus server In affected versions of Octopus Server the preview import feature could be leveraged to identify... CVE-2025-0525 2.3 LowFebruary 11, 2025
• octopus server In affected versions of Octopus Deploy where customers are using Active Directory for... CVE-2025-0589 6.9 MediumFebruary 11, 2025
• octopus deploy kubernetes worker or kubernetes agent In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be... CVE-2024-12226 6.5 MediumJanuary 16, 2025
• linux and microsoft windows octopus server, octopus server +1 more SQL Injection in the Octopus Server REST API CVE-2024-9194 8.7 HighSeptember 30, 2024
• octopus server Affected versions of Octopus Server had a weak content security policy. CVE-2024-1656 2.6 LowSeptember 11, 2024
• octopus server In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which... CVE-2024-7998 2.6 LowAugust 21, 2024
• octopus server In affected versions of Octopus Server under certain circumstances it is possible for sensitive... CVE-2024-6972 6.5 MediumJuly 25, 2024
• octopus server In affected versions of Octopus Server under certain conditions, a user with specific role... CVE-2024-4811 2.2 LowJuly 25, 2024
• octopus server In affected versions of Octopus Server with certain access levels it was possible to embed a... CVE-2024-4456 4.1 MediumMay 8, 2024
• octopus server It was identified that in certain versions of Octopus Server, that a user created with no... CVE-2024-4226 3.5 LowApril 30, 2024
• octopus server It is possible for an API key to be logged in clear text in the audit log file after an invalid... CVE-2023-4509 4.3 MediumApril 17, 2024
• octopus server A race condition was identified through which privilege escalation was possible in certain... CVE-2024-2975 8.8 HighApril 9, 2024
• octopus server In affected versions of Octopus Server it is possible for the OpenID client secret to be logged... CVE-2023-1904 4.2 MediumDecember 14, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a... CVE-2022-2416 5.5 MediumAugust 2, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact... CVE-2022-2346 5.5 MediumAugust 2, 2023
• octopus server In affected versions of Octopus Deploy it is possible to discover network details via error message CVE-2022-4870 5.3 MediumMay 18, 2023
• octopus server, octopus deploy tentacle +1 more In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which... CVE-2022-4008 5.5 MediumMay 10, 2023
• octopus deploy, octopus deploy server +1 more In affected versions of Octopus Deploy it is possible to unmask variable secrets using the... CVE-2023-2247 5.3 MediumMay 2, 2023
• octopus server In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage CVE-2022-2507 5.3 MediumApril 19, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a user to introduce code via offline... CVE-2022-4009 8.8 HighMarch 16, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a user to view Workerpools without... CVE-2022-2259 4.3 MediumMarch 13, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being... CVE-2022-2258 4.3 MediumMarch 13, 2023
• octopus server In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which... CVE-2022-2883 7.5 HighFebruary 22, 2023
• octopus server In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site... CVE-2022-4898 5.4 MediumJanuary 31, 2023
• octopus server In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus... CVE-2022-3614 6.1 MediumJanuary 3, 2023
• octopus server In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to... CVE-2022-3460 7.5 HighJanuary 2, 2023
• octopus server In affected versions of Octopus Server it is possible for target discovery to print certain... CVE-2022-2721 7.5 HighNovember 25, 2022
• Show olderLoading…