Octopus Server vulnerabilities

• octopus server In affected versions of Octopus Server under certain circumstances it is possible for sensitive... CVE-2026-14163 7.1 HighAugust 20, 2026
• octopus server In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows... CVE-2026-12702 5.1 MediumJuly 24, 2026
• octopus server In affected versions of Octopus Server, permissions were not checked correctly resulting in any... CVE-2026-4881 6.0 MediumJune 4, 2026
• octopus server In affected versions of Octopus Server it was possible for a low privileged user to manipulate an... CVE-2026-3237 2.3 LowMarch 17, 2026
• octopus server In affected versions of Octopus Server it was possible to create a new API key from an existing... CVE-2026-3236 2.3 LowMarch 5, 2026
• octopus server In affected version of Octopus Deploy it was possible to remove files and/or contents of files on... CVE-2026-0704 5.9 MediumFebruary 25, 2026
• octopus server In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending... CVE-2025-0539 5.9 MediumApril 10, 2025
• octopus server In affected versions of Octopus Server it was possible for a user with sufficient access to set... CVE-2025-0588 5.9 MediumFebruary 11, 2025
• octopus server In affected versions of Octopus Server error messages were handled unsafely on the error page. If... CVE-2025-0513 1.8 LowFebruary 11, 2025
• octopus server In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on... CVE-2025-0526 2.3 LowFebruary 11, 2025
• octopus server In affected versions of Octopus Server the preview import feature could be leveraged to identify... CVE-2025-0525 2.3 LowFebruary 11, 2025
• octopus server In affected versions of Octopus Deploy where customers are using Active Directory for... CVE-2025-0589 6.9 MediumFebruary 11, 2025
• linux and microsoft windows octopus server, octopus server +1 more SQL Injection in the Octopus Server REST API CVE-2024-9194 8.7 HighSeptember 30, 2024
• octopus server Affected versions of Octopus Server had a weak content security policy. CVE-2024-1656 2.6 LowSeptember 11, 2024
• octopus server In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which... CVE-2024-7998 2.6 LowAugust 21, 2024
• octopus server In affected versions of Octopus Server under certain circumstances it is possible for sensitive... CVE-2024-6972 6.5 MediumJuly 25, 2024
• octopus server In affected versions of Octopus Server under certain conditions, a user with specific role... CVE-2024-4811 2.2 LowJuly 25, 2024
• octopus server In affected versions of Octopus Server with certain access levels it was possible to embed a... CVE-2024-4456 4.1 MediumMay 8, 2024
• octopus server It was identified that in certain versions of Octopus Server, that a user created with no... CVE-2024-4226 3.5 LowApril 30, 2024
• octopus server It is possible for an API key to be logged in clear text in the audit log file after an invalid... CVE-2023-4509 4.3 MediumApril 17, 2024
• octopus server A race condition was identified through which privilege escalation was possible in certain... CVE-2024-2975 8.8 HighApril 9, 2024
• octopus server In affected versions of Octopus Server it is possible for the OpenID client secret to be logged... CVE-2023-1904 4.2 MediumDecember 14, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a... CVE-2022-2416 5.5 MediumAugust 2, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact... CVE-2022-2346 5.5 MediumAugust 2, 2023
• octopus server In affected versions of Octopus Deploy it is possible to discover network details via error message CVE-2022-4870 5.3 MediumMay 18, 2023
• octopus server, octopus deploy tentacle +1 more In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which... CVE-2022-4008 5.5 MediumMay 10, 2023
• octopus server In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage CVE-2022-2507 5.3 MediumApril 19, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a user to introduce code via offline... CVE-2022-4009 8.8 HighMarch 16, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a user to view Workerpools without... CVE-2022-2259 4.3 MediumMarch 13, 2023
• octopus server In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being... CVE-2022-2258 4.3 MediumMarch 13, 2023
• octopus server In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which... CVE-2022-2883 7.5 HighFebruary 22, 2023
• octopus server In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site... CVE-2022-4898 5.4 MediumJanuary 31, 2023
• octopus server In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus... CVE-2022-3614 6.1 MediumJanuary 3, 2023
• octopus server In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to... CVE-2022-3460 7.5 HighJanuary 2, 2023
• octopus server In affected versions of Octopus Server it is possible for target discovery to print certain... CVE-2022-2721 7.5 HighNovember 25, 2022
• octopus server In affected versions of Octopus Server where access is managed by an external authentication... CVE-2022-2572 9.8 CriticalNovember 1, 2022
• octopus server In affected versions of Octopus Server it is possible to reveal the existence of resources in a... CVE-2022-2508 5.3 MediumOctober 27, 2022
• octopus server In affected versions of Octopus Server it is possible for a session token to be valid... CVE-2022-2782 9.1 CriticalOctober 26, 2022
• octopus server In affected versions of Octopus Server it is possible to use the Git Connectivity test function... CVE-2022-2780 8.1 HighOctober 14, 2022
• octopus server In affected versions of Octopus Server it is possible to reveal information about teams via the... CVE-2022-2828 6.5 MediumOctober 13, 2022
• octopus server In affected versions of Octopus Server it was identified that when a sensitive value is a... CVE-2022-2720 5.3 MediumOctober 12, 2022
• octopus server In affected versions of Octopus Server it was identified that a session cookie could be used as... CVE-2022-2783 5.3 MediumOctober 6, 2022
• octopus server In affected versions of Octopus Server it was identified that the same encryption process was... CVE-2022-2781 5.3 MediumOctober 6, 2022
• octopus server In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null... CVE-2022-2778 9.8 CriticalSeptember 30, 2022
• octopus server In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the... CVE-2022-2760 4.3 MediumSeptember 28, 2022
• octopus server In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with... CVE-2022-2528 6.5 MediumSeptember 9, 2022
• octopus server In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service... CVE-2022-2075 7.5 HighAugust 19, 2022
• octopus server In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using... CVE-2022-2074 7.5 HighAugust 19, 2022
• octopus server In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via... CVE-2022-2049 7.5 HighAugust 19, 2022
• octopus server In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using... CVE-2022-1901 5.3 MediumAugust 19, 2022
• Show olderLoading…