thoughtworks gocd

Name: thoughtworks gocd
Brand: thoughtworks

productUS

cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical9high11medium0low

updated 2026-10-28

vulnerabilities (23)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-43287US	high7.5	27.4% (98th)	Exploit	21.3.0	2022-04-14	< 21.3.0
CVE-2022-29184US	high8.8	3.63% (89th)	—	22.1.0	2022-05-20	< 22.1.0
CVE-2021-43290US	critical9.8	3.22% (88th)	—	21.3.0	2022-04-14	< 21.3.0
CVE-2021-43286US	high8.8	2.90% (87th)	—	21.3.0	2022-04-14	< 21.3.0
CVE-2021-44659US	critical9.8	2.61% (85th)	—	no fix	2021-12-22	= 21.3.0
CVE-2021-43289US	high7.5	2.34% (84th)	—	21.3.0	2022-04-14	< 21.3.0
CVE-2022-39311US	high8.8	2.17% (82nd)	—	21.1.0	2022-10-14	< 21.1.0
CVE-2022-24832US	medium6.8	1.70% (77th)	—	22.1.0	2022-04-11	17.5.0 → 22.1.0
CVE-2022-39309US	medium6.5	1.04% (64th)	—	21.1.0	2022-10-14	< 21.1.0
CVE-2021-43288US	medium5.4	0.91% (60th)	—	21.3.0	2022-04-14	< 21.3.0
CVE-2022-29183US	medium6.1	0.87% (59th)	—	21.4.0	2022-05-20	20.2.0 → 21.4.0
CVE-2022-29182US	medium5.4	0.86% (58th)	—	no fix	2022-05-20	19.11.0 → 21.4.0
CVE-2022-39308US	medium5.9	0.85% (58th)	—	19.11.0	2022-10-14	19.2.0 → 19.11.0
CVE-2022-39310US	medium6.5	0.84% (58th)	—	21.1.0	2022-10-14	< 21.1.0
CVE-2024-56324US	high7.1	0.81% (57th)	—	24.5.0	2025-01-03	< 24.5.0
CVE-2021-25924US	high8.8	0.75% (55th)	—	21.2.0	2021-04-01	19.6.0 → 21.2.0
CVE-2024-56320US	high8.8	0.74% (54th)	—	24.5.0	2025-01-03	< 24.5.0
CVE-2024-56322US	high7.2	0.72% (54th)	—	24.5.0	2025-01-03	16.7.0 → 24.5.0
CVE-2024-56321US	—	0.56% (47th)	—	24.5.0	2025-01-03	18.9.0 → 24.5.0
CVE-2023-28629US	medium5.4	0.50% (43rd)	—	23.1.0	2023-03-27	< 23.1.0
CVE-2024-28866US	medium6.1	0.42% (36th)	—	24.1.0	2024-05-14	19.4.0 → 24.1.0
CVE-2023-28630US	medium4.4	0.25% (17th)	—	23.1.0	2023-03-27	20.5.0 → 23.1.0
CVE-2022-36088US	medium5.5	0.23% (14th)	—	22.2.0	2022-09-07	< 22.2.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-284Improper Access Control2 CVEs
CWE-611Improper Restriction of XML External Entity Reference2 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')2 CVEs
CWE-1254Incorrect Comparison Logic Granularity1 CVEs
CWE-20Improper Input Validation1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE23 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan