Octopus

What is Octopus ? Octopus is an open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S. The main purpose of creating Octopus is for use before any red team operation, where rather than starting the engagement with your full operational...

CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search...

EUVD-2026-112580

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search...

CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user can call the LDAP user search and LDAP group search functions. This issue is categorized as a Missing Authorization vulnerability (CWE-862) and carries a CVSS 4.0 base score of 5.3 (Medium...

octopus

Octopus Huge thanks to QuoScient for having sponsored this project. Octopus is a security analysis framework for WebAssembly module and Blockchain Smart Contract. The purpose of Octopus is to provide an easy way to analyze closed-source WebAssembly module and smart contracts bytecode to understan...

CVE-2026-12887

In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory...

CVE-2026-12887

In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory...

EUVD-2026-110853

In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory...

CVE-2026-12887

In affected versions of Octopus Server , a user with permissions to upload a malicious nuget package can deploy a script step that executes outside of the parent directory. The documents do not specify the exact root cause, impacted versions, or available remediation, and no exploits are currentl...

CVE-2026-117341

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the...

CVE-2026-117466

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator...

CVE-2026-116870

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires ...

CVE-2026-117466

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator...

CVE-2026-117466

In affected versions of Octopus Server , a user with the System Manager role can perform a privilege escalation to gain full system Administrator permissions. This vulnerability is associated with CWE-269 (Improper Privilege Management). No specific root cause, affected versions, or remediation s...

EUVD-2026-110724

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator...

CVE-2026-117341

In affected versions of Octopus Server , the application writes invitation codes to the audit event log during the creation of a user invitation. A user within a linked space who possesses sufficient permissions can read these codes from the logs. If an attacker redeems an unclaimed invitation, t...

EUVD-2026-110723

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the...

CVE-2026-117341

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the...

CVE-2026-116870

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires ...

EUVD-2026-110722

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires ...