OD
Vendor
Octopus Deploy
55
CVEs
0
On KEV
8
New 30D
Products
OS9.8
Octopus Server
Octopus Deploy
52 CVEs0 on KEV8 new
CO8.8
Codefresh
Octopus Deploy
1 CVEs0 on KEV0 new
KW6.5
Kubernetes Worker or Kubernetes Agent
Octopus Deploy
1 CVEs0 on KEV0 new
OT5.5
Octopus Tentacle
Octopus Deploy
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118426 New | OS Octopus Server Octopus Deploy | 5.3 | Oct 29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search |
| CVE-2026-12887 New | OS Octopus Server Octopus Deploy | 5.1 | Oct 27 | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent… |
| CVE-2026-117466 New | OS Octopus Server Octopus Deploy | 8.6 | Oct 27 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator |
| CVE-2026-117341 New | OS Octopus Server Octopus Deploy | 7.7 | Oct 27 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log |
| CVE-2026-116870 New | OS Octopus Server Octopus Deploy | 8.7 | Oct 27 | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently |
| CVE-2026-102488 | OS Octopus Server Octopus Deploy | 8.7 | Oct 8 | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those… |
| CVE-2026-102478 | OS Octopus Server Octopus Deploy | 8.7 | Oct 7 | In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege… |
| CVE-2026-78210 | OS Octopus Server Octopus Deploy | 7.1 | Oct 1 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization |
| CVE-2026-101169 | OS Octopus Server Octopus Deploy | 8.7 | Sep 29 | In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object |
| CVE-2026-92355 | OS Octopus Server Octopus Deploy | 8.7 | Sep 16 | In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the… |
| CVE-2026-91778 | OS Octopus Server Octopus Deploy | 7.2 | Sep 15 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker) |
| CVE-2026-12878 | CO Codefresh Octopus Deploy | 8.8 | Aug 25 | In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions |
| CVE-2026-14163 | OS Octopus Server Octopus Deploy | 7.5 | Aug 20 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text |
| CVE-2026-12702 | OS Octopus Server Octopus Deploy | 4.9 | Jul 24 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment |
| CVE-2026-8296 | OS Octopus Server Octopus Deploy | 5.6 | Jun 19 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts |
| CVE-2026-4881 | OS Octopus Server Octopus Deploy | 6.5 | Jun 4 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API… |
| CVE-2026-3237 | OS Octopus Server Octopus Deploy | 4.3 | Mar 17 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via… |
| CVE-2026-3236 | OS Octopus Server Octopus Deploy | 4.3 | Mar 5 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original… |
| CVE-2026-0704 | OS Octopus Server Octopus Deploy | 9.1 | Feb 25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint |
| CVE-2025-0539 | OS Octopus Server Octopus Deploy | 8.8 | Apr 10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably… |
| CVE-2025-0588 | OS Octopus Server Octopus Deploy | 4.9 | Feb 11 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses |
| CVE-2025-0513 | OS Octopus Server Octopus Deploy | 5.4 | Feb 11 | In affected versions of Octopus Server error messages were handled unsafely on the error page |
| CVE-2025-0526 | OS Octopus Server Octopus Deploy | 5.4 | Feb 11 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint |
| CVE-2025-0525 | OS Octopus Server Octopus Deploy | 7.5 | Feb 11 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file |
| CVE-2025-0589 | OS Octopus Server Octopus Deploy | 5.3 | Feb 11 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API request against two… |
| CVE-2024-12226 | KW Kubernetes Worker or Kubernetes Agent Octopus Deploy | 6.5 | Jan 16 | In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text |
| CVE-2024-1656 | OS Octopus Server Octopus Deploy | 2.6 | Sep 11 | Affected versions of Octopus Server had a weak content security policy |
| CVE-2024-7998 | OS Octopus Server Octopus Deploy | 2.6 | Aug 21 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan |
| CVE-2024-6972 | OS Octopus Server Octopus Deploy | 6.5 | Jul 25 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text |
| CVE-2024-4811 | OS Octopus Server Octopus Deploy | 2.2 | Jul 25 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts |
| CVE-2024-4456 | OS Octopus Server Octopus Deploy | 5.4 | May 8 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page |
| CVE-2024-4226 | OS Octopus Server Octopus Deploy | 3.5 | Apr 30 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions |
| CVE-2023-4509 | OS Octopus Server Octopus Deploy | 4.3 | Apr 17 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt |
| CVE-2024-2975 | OS Octopus Server Octopus Deploy | 7.5 | Apr 9 | A race condition was identified through which privilege escalation was possible in certain configurations |
| CVE-2023-1904 | OS Octopus Server Octopus Deploy | 7.5 | Dec 14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server |
| CVE-2022-2416 | OS Octopus Server Octopus Deploy | 4.3 | Aug 2 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment |
| CVE-2022-2346 | OS Octopus Server Octopus Deploy | 4.3 | Aug 2 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints |
| CVE-2022-4870 | OS Octopus Server Octopus Deploy | 5.3 | May 18 | In affected versions of Octopus Deploy it is possible to discover network details via error message |
| CVE-2022-4008 | OT Octopus Tentacle Octopus Deploy | 5.5 | May 10 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
| CVE-2023-2247 | OS Octopus Server Octopus Deploy | 5.3 | May 2 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function |
| CVE-2022-2507 | OS Octopus Server Octopus Deploy | 5.3 | Apr 19 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage |
| CVE-2022-4009 | OS Octopus Server Octopus Deploy | 8.8 | Mar 16 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation |
| CVE-2022-2258 | OS Octopus Server Octopus Deploy | 4.3 | Mar 13 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items |
| CVE-2022-2259 | OS Octopus Server Octopus Deploy | 4.3 | Mar 13 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items |
| CVE-2022-2883 | OS Octopus Server Octopus Deploy | 7.5 | Feb 22 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
| CVE-2022-4898 | OS Octopus Server Octopus Deploy | 5.4 | Jan 31 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link |
| CVE-2022-2572 | OS Octopus Server Octopus Deploy | 9.8 | Nov 1 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still… |
| CVE-2022-2508 | OS Octopus Server Octopus Deploy | 5.3 | Oct 27 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging |
| CVE-2022-2782 | OS Octopus Server Octopus Deploy | 9.1 | Oct 26 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters |
| CVE-2022-2780 | OS Octopus Server Octopus Deploy | 8.1 | Oct 14 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an… |
| CVE-2022-2828 | OS Octopus Server Octopus Deploy | 6.5 | Oct 13 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2022-2720 | OS Octopus Server Octopus Deploy | 5.3 | Oct 12 | In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, sensitive value masking will only partially work |
| CVE-2022-2783 | OS Octopus Server Octopus Deploy | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token |
| CVE-2022-2781 | OS Octopus Server Octopus Deploy | 5.3 | Oct 6 | In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables |
| CVE-2022-2778 | OS Octopus Server Octopus Deploy | 9.8 | Sep 30 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes |