Octopus Server CVE-2026-0704

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment

In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn

In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical

In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va

In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof

In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to in

When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an

A race condition was identified through which privilege escalation was possible in certain configurations. Rated high se

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the

In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive t