OC
Vendor
Octopus
113
CVEs
0
On KEV
0
New 30D
Products
OS9.8
Octopus Server
Octopus
66 CVEs0 on KEV0 new
OD8.8
Octopus Deploy
Octopus
31 CVEs0 on KEV0 new
SE7.5
Server
Octopus
9 CVEs0 on KEV0 new
TE7.8
Tentacle
Octopus
4 CVEs0 on KEV0 new
CO8.8
Codefresh
Octopus
1 CVEs0 on KEV0 new
HA9.8
Halibut
Octopus
1 CVEs0 on KEV0 new
OC5.5
Octopusdsc
Octopus
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-12878 | CO Codefresh Octopus | 8.8 | Aug 25 | In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions |
| CVE-2026-14163 | OS Octopus Server Octopus | 7.5 | Aug 20 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text |
| CVE-2026-12702 | OS Octopus Server Octopus | 4.9 | Jul 24 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment |
| CVE-2026-4881 | OS Octopus Server Octopus | 6.5 | Jun 4 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API… |
| CVE-2026-3237 | OS Octopus Server Octopus | 4.3 | Mar 17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via… |
| CVE-2026-3236 | OS Octopus Server Octopus | 4.3 | Mar 5 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original… |
| CVE-2026-0704 | OS Octopus Server Octopus | 9.1 | Feb 25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint |
| CVE-2025-0539 | OS Octopus Server Octopus | 8.8 | Apr 10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably… |
| CVE-2025-0588 | OS Octopus Server Octopus | 4.9 | Feb 11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses |
| CVE-2025-0513 | OS Octopus Server Octopus | 5.4 | Feb 11 | In affected versions of Octopus Server error messages were handled unsafely on the error page |
| CVE-2025-0526 | OS Octopus Server Octopus | 5.4 | Feb 11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint |
| CVE-2025-0525 | OS Octopus Server Octopus | 7.5 | Feb 11 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file |
| CVE-2025-0589 | OS Octopus Server Octopus | 5.3 | Feb 11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two… |
| CVE-2024-9194 | OS Octopus Server Octopus | 9.8 | Sep 30 | SQL Injection in the Octopus Server REST API |
| CVE-2024-1656 | OS Octopus Server Octopus | 2.6 | Sep 11 | Affected versions of Octopus Server had a weak content security policy |
| CVE-2024-7998 | OS Octopus Server Octopus | 2.6 | Aug 21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan |
| CVE-2024-6972 | OS Octopus Server Octopus | 6.5 | Jul 25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text |
| CVE-2024-4811 | OS Octopus Server Octopus | 2.2 | Jul 25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts |
| CVE-2024-4456 | OS Octopus Server Octopus | 5.4 | May 8 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page |
| CVE-2024-4226 | OS Octopus Server Octopus | 3.5 | Apr 30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions |
| CVE-2023-4509 | OS Octopus Server Octopus | 4.3 | Apr 17 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt |
| CVE-2024-2975 | OS Octopus Server Octopus | 7.5 | Apr 9 | A race condition was identified through which privilege escalation was possible in certain configurations |
| CVE-2023-1904 | OS Octopus Server Octopus | 7.5 | Dec 14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server |
| CVE-2022-2416 | OS Octopus Server Octopus | 4.3 | Aug 2 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment |
| CVE-2022-2346 | OS Octopus Server Octopus | 4.3 | Aug 2 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints |
| CVE-2022-4870 | OS Octopus Server Octopus | 5.3 | May 18 | In affected versions of Octopus Deploy it is possible to discover network details via error message |
| CVE-2022-4008 | OS Octopus Server Octopus | 5.5 | May 10 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
| CVE-2023-2247 | OD Octopus Deploy Octopus | 5.3 | May 2 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function |
| CVE-2022-2507 | OS Octopus Server Octopus | 5.3 | Apr 19 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage |
| CVE-2022-4009 | OS Octopus Server Octopus | 8.8 | Mar 16 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation |
| CVE-2022-2259 | OS Octopus Server Octopus | 4.3 | Mar 13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
| CVE-2022-2258 | OS Octopus Server Octopus | 4.3 | Mar 13 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items |
| CVE-2022-2883 | OS Octopus Server Octopus | 7.5 | Feb 22 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
| CVE-2022-4898 | OS Octopus Server Octopus | 5.4 | Jan 31 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link |
| CVE-2022-3614 | OS Octopus Server Octopus | 6.1 | Jan 3 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the… |
| CVE-2022-3460 | OS Octopus Server Octopus | 7.5 | Jan 3 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview |
| CVE-2022-2721 | OS Octopus Server Octopus | 7.5 | Nov 25 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is… |
| CVE-2022-2572 | OS Octopus Server Octopus | 9.8 | Nov 1 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still… |
| CVE-2022-2508 | OS Octopus Server Octopus | 5.3 | Oct 27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging |
| CVE-2022-2782 | OS Octopus Server Octopus | 9.1 | Oct 26 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters |
| CVE-2022-2780 | OS Octopus Server Octopus | 8.1 | Oct 14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an… |
| CVE-2022-2828 | OS Octopus Server Octopus | 6.5 | Oct 13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2022-2720 | OS Octopus Server Octopus | 5.3 | Oct 12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work |
| CVE-2022-2781 | OS Octopus Server Octopus | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables |
| CVE-2022-2783 | OS Octopus Server Octopus | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
| CVE-2022-2778 | OS Octopus Server Octopus | 9.8 | Sep 30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes |
| CVE-2022-2760 | OS Octopus Server Octopus | 4.3 | Sep 28 | In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of… |
| CVE-2022-2528 | OS Octopus Server Octopus | 6.5 | Sep 9 | In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages |
| CVE-2022-2075 | OS Octopus Server Octopus | 7.5 | Aug 19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation |
| CVE-2022-2074 | OS Octopus Server Octopus | 7.5 | Aug 19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template |
| CVE-2022-2049 | OS Octopus Server Octopus | 7.5 | Aug 19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function |
| CVE-2022-1901 | OS Octopus Server Octopus | 5.3 | Aug 19 | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview |
| CVE-2022-30532 | OS Octopus Server Octopus | 5.3 | Jul 19 | In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy |
| CVE-2022-29890 | OS Octopus Server Octopus | 6.1 | Jul 15 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link |
| CVE-2022-1881 | OS Octopus Server Octopus | 5.3 | Jul 15 | In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do… |
| CVE-2022-2013 | OD Octopus Deploy Octopus | 7.5 | Jun 13 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script… |
| CVE-2022-1670 | OS Octopus Server Octopus | 7.5 | May 19 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users |
| CVE-2022-1502 | SE Server Octopus | 4.3 | May 4 | Permissions were not properly verified in the API on projects using version control in Git |
| CVE-2022-23184 | OS Octopus Server Octopus | 6.1 | Feb 7 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects |
| CVE-2021-31821 | TE Tentacle Octopus | 5.5 | Jan 19 | When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext |