Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,565All CVEsplus 18,890 rejected
- 356Last 24 hours2,974 in the last 7 days
- 17,093Last 30 days1,578 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 11 | 6 | 2 | 0 | 19 | 81 |
| 2025 | 0 | 0 | 4 | 3 | 0 | 7 | 62 |
| 2024 | 0 | 2 | 3 | 4 | 0 | 9 | 55 |
| 2023 | 0 | 3 | 11 | 0 | 0 | 14 | 46 |
| 2022 | 3 | 7 | 14 | 0 | 0 | 24 | 32 |
| 2021 | 1 | 6 | 1 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-118426 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group…Octopus Deploy · Octopus Server | Medium5.3 |
| CVE-2026-12887 | In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes…Octopus Deploy · Octopus Server | Medium5.1 |
| CVE-2026-117466 | In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.Octopus Deploy · Octopus Server | High8.6 |
| CVE-2026-117341 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space,…Octopus Deploy · Octopus Server | High7.7 |
| CVE-2026-116870 | In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably…Octopus Deploy · Octopus Server | High8.7 |
| CVE-2026-102488 | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment…Octopus Deploy · Octopus Server | High8.7 |
| CVE-2026-102478 | In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in…Octopus Deploy · Octopus Server | High8.7 |
| CVE-2026-78210 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the…Octopus Deploy · Octopus Server | High7.1 |
| CVE-2026-101169 | In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for…Octopus Deploy · Octopus Server | High8.7 |
| CVE-2026-92355 | In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary…Octopus Deploy · Octopus Server | High8.7 |
| CVE-2026-91778 | In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server…Octopus Deploy · Octopus Server | High7.2 |
| CVE-2026-12878 | In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.Octopus Deploy · Codefresh | High8.6 |
| CVE-2026-14163 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in…Octopus Deploy · Octopus Server | High7.1 |
| CVE-2026-12702 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment.Octopus Deploy · Octopus Server | Medium5.1 |
| CVE-2026-8296 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.Octopus Deploy · Octopus Server | Medium5.6 |
| CVE-2026-4881 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes…Octopus Deploy · Octopus Server | Medium6.0 |
| CVE-2026-3237 | In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and…Octopus Deploy · Octopus Server | Low2.3 |
| CVE-2026-3236 | In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime…Octopus Deploy · Octopus Server | Low2.3 |
| CVE-2026-0704 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation…Octopus Deploy · Octopus Server | Medium5.9 |
| CVE-2025-0539 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material…Octopus Deploy · Octopus Server | Medium5.9 |
| CVE-2025-0588 | In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By submitting a…Octopus Deploy · Octopus Server | Medium5.9 |
| CVE-2025-0513 | In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they…Octopus Deploy · Octopus Server | Low1.8 |
| CVE-2025-0526 | In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation…Octopus Deploy · Octopus Server | Low2.3 |
| CVE-2025-0525 | In affected versions of Octopus Server the preview import feature could be leveraged to identify the existence of a target file. This could provide an…Octopus Deploy · Octopus Server | Low2.3 |
| CVE-2025-0589 | In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated user to make an API…Octopus Deploy · Octopus Server | Medium6.9 |
| CVE-2024-12226 | In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was…Octopus Deploy · Kubernetes Worker or Kubernetes Agent | Medium6.5 |
| CVE-2024-9194 | SQL Injection in the Octopus Server REST APILinux and Microsoft Windows · Octopus Server | High8.7 |
| CVE-2024-1656 | Affected versions of Octopus Server had a weak content security policy.Octopus Deploy · Octopus Server | Low2.6 |
| CVE-2024-7998 | In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.Octopus Deploy · Octopus Server | Low2.6 |
| CVE-2024-6972 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text.Octopus Deploy · Octopus Server | Medium6.5 |
| CVE-2024-4811 | In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacts.Octopus Deploy · Octopus Server | Low2.2 |
| CVE-2024-4456 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.Octopus Deploy · Octopus Server | Medium4.1 |
| CVE-2024-4226 | It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This…Octopus Deploy · Octopus Server | Low3.5 |
| CVE-2023-4509 | It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt.Octopus Deploy · Octopus Server | Medium4.3 |
| CVE-2024-2975 | A race condition was identified through which privilege escalation was possible in certain configurations.Octopus Deploy · Octopus Server | High8.8 |
| CVE-2023-1904 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.Octopus Deploy · Octopus Server | Medium4.2 |
| CVE-2022-2416 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an environment.Octopus Deploy · Octopus Server | Medium5.5 |
| CVE-2022-2346 | In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.Octopus Deploy · Octopus Server | Medium5.5 |
| CVE-2022-4870 | In affected versions of Octopus Deploy it is possible to discover network details via error messageOctopus Deploy · Octopus Server | Medium5.3 |
| CVE-2022-4008 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceOctopus Deploy · Octopus Tentacle | Medium5.5 |
| CVE-2023-2247 | In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview functionOctopus Deploy · Octopus Server | Medium5.3 |
| CVE-2022-2507 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpageOctopus Deploy · Octopus Server | Medium5.3 |
| CVE-2022-4009 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creationOctopus Deploy · Octopus Server | High8.8 |
| CVE-2022-2259 | In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these itemsOctopus Deploy · Octopus Server | Medium4.3 |
| CVE-2022-2258 | In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these itemsOctopus Deploy · Octopus Server | Medium4.3 |
| CVE-2022-2883 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of ServiceOctopus Deploy · Octopus Server | High7.5 |
| CVE-2022-4898 | In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially…Octopus Deploy · Octopus Server | Medium5.4 |
| CVE-2022-3614 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be…Octopus Deploy · Octopus Server | Medium6.1 |
| CVE-2022-3460 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.Octopus Deploy · Octopus Server | High7.5 |
| CVE-2022-2721 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when…Octopus Deploy · Octopus Server | High7.5 |