1357 matches found
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CVE-2026-101169
Affected versions of Octopus Server are vulnerable to insecure deserialization of specifically crafted JSON content. An authenticated user with permissions to edit an Environment or Project can exploit this flaw to execute arbitrary code within the Octopus Server process. No specific patch versio...
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
EUVD-2026-88654
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CVE-2026-101169
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
CVE-2026-101169: Deserialization of Untrusted Data
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...
PT-2026-102457
Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which...
Malicious Package
Overview lava-octopus-tna469-project is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CVE-2026-92355
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
CVE-2026-92355
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
EUVD-2026-80225
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
CVE-2026-92355
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
CVE-2026-92355
Octopus Server is affected by a path traversal flaw in the handling of non built-in external feeds. A user with low privileges (specifically, permission to modify non built-in external feeds) can exploit this to overwrite arbitrary files on the server. In some configurations, this may escalate to...
CVE-2026-92355: Improper Limitation of a Pathname to a Restricted Directory
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
PT-2026-93337
Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description A path traversal flaw exists where a user with permissions to modify non built-in external feeds can overwrite arbitrary files on the server. In certain configurations, this action cou...
CVE-2026-91778
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...
CVE-2026-91778
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...
EUVD-2026-78314
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...
CVE-2026-91778
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker including the Octopus Server built-in worker. Incorrect permission validation during script execution would allow the script to execute without the user possessing the...
CVE-2026-91778
CVE-2026-91778 affects Octopus Server and stems from incorrect permission validation during script execution. Users holding certain scoped permission sets can execute arbitrary scripts on a worker—including the Octopus Server built-in worker—without possessing the required authorization. This is ...