CVE Tools
Track your stack

Octopus-deploy

25 CVEs tracked since 2022. Since Jul 2022, none of them reached CISA KEV.

Octopus-deploy CVEs per month

Jul 2022 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Octopus-deploy CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2022-0730
2022-0840
2022-0930
2022-1070
2022-113 or fewer
2022-123 or fewer
2023-0130
2023-023 or fewer
2023-03no snapshot
2023-043 or fewer
2023-053 or fewer
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-014 or fewer
2024-024 or fewer
2024-034 or fewer
2024-044 or fewer
2024-055 or fewer
2024-064 or fewer
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-0250
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-103 or fewer

Products

The products that kept showing up in Octopus-deploy's monthly top three, with their CVEs summed over those months.

  1. Octopus Server256 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Octopus-deploy.

  1. CVE-2026-102488In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted t...—
  2. CVE-2026-102478In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible...—
  3. CVE-2026-78210In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.—
  4. CVE-2026-101169In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization o...—
  5. CVE-2026-92355In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some co...—
  6. CVE-2026-91778In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission va...—
  7. CVE-2026-12878In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.8.8
  8. CVE-2026-14163In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.7.5
  9. CVE-2026-12702In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.4.9
  10. CVE-2026-8296In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.—
  11. CVE-2026-4881In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite recei...6.5
  12. CVE-2026-3237In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint tha...4.3
  13. CVE-2026-3236In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mi...—
  14. CVE-2026-0704In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways ...9.1
  15. CVE-2025-0539In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to...8.8

The record

Peak rank
#89 in Oct 2022
Busiest month shown
Oct 2022, 7 CVEs
Months with a KEV entry
0 since Jul 2022
Monthly snapshots
6 since 2022
Octopus-deploy's full record, month by month