Octopus Deploy Octopus Deploy

Name: Octopus Deploy Octopus Deploy
Brand: Octopus Deploy

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical6high9medium0low

updated 2026-10-28

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-55315US	—	66.5% (99th)	Exploit	no fix	2025-10-14	3 versions
CVE-2025-55248US	medium5.7	0.72% (54th)	—	no fix	2025-10-14	3 versions
CVE-2026-92355US	—	0.69% (52nd)	—	2026.2.13344	2026-09-16	3 versions
CVE-2025-55247US	high7.3	0.61% (49th)	—	no fix	2025-10-14	3 versions
CVE-2025-25004US	high7.3	0.48% (41st)	—	no fix	2025-10-14	3 versions
CVE-2024-9194US	critical9.8	0.43% (37th)	—	2024.1.13038	2024-09-30	3 versions
CVE-2025-0588US	medium4.9	0.42% (36th)	—	2024.4.7091	2025-02-11	3 versions
CVE-2024-2975US	high7.5	0.39% (33rd)	—	2024.1.12087	2024-04-09	3 versions
CVE-2025-54132US	high7.5	0.38% (32nd)	—	no fix	2025-08-01	3 versions
CVE-2026-0704US	critical9.1	0.38% (32nd)	—	2025.4.10359	2026-02-25	2 versions
CVE-2025-0525US	high7.5	0.38% (31st)	—	2024.3.13097	2025-02-11	3 versions
CVE-2025-0589US	medium5.3	0.37% (31st)	—	2024.4.7065	2025-02-11	2 versions
CVE-2025-55240US	—	0.37% (30th)	—	no fix	2025-10-14	3 versions
CVE-2025-0539US	high8.8	0.36% (30th)	—	no fix	2025-04-10	2 versions
CVE-2024-12226US	—	0.35% (29th)	—	no fix	2025-01-16	2 versions
CVE-2025-0526US	medium5.4OT elevated	0.35% (28th)	—	2024.4.6962	2025-02-11	3 versions
CVE-2026-101169US	—	0.35% (28th)	—	2026.2.13441	2026-09-29	3 versions
CVE-2026-12702US	medium4.9	0.33% (26th)	—	no fix	2026-07-24	2 versions
CVE-2026-8296US	—	0.32% (24th)	—	no fix	2026-06-19	≤ Server <2026.2.13115
CVE-2026-102478US	—	0.29% (22nd)	—	2026.1.11768	2026-10-07	3 versions
CVE-2026-78210US	—OT elevated	0.26% (17th)	—	2026.2.13364	2026-10-01	3 versions
CVE-2024-7998US	—	0.25% (16th)	—	2024.3.7083	2024-08-21	3 versions
CVE-2024-1656US	—	0.25% (16th)	—	2024.2.9193	2024-09-11	< 2024.2.9193
CVE-2025-0513US	medium5.4	0.24% (15th)	—	2024.4.6995	2025-02-11	3 versions
CVE-2026-4881US	medium6.5OT elevated	0.21% (11th)	—	2026.1.11481	2026-06-04	3 versions
CVE-2026-102488US	—OT elevated	0.21% (11th)	—	2026.2.13438	2026-10-08	4 versions
CVE-2026-3236US	medium4.3OT elevated	0.16% (5th)	—	2025.3.14761	2026-03-05	2 versions
CVE-2026-3237US	medium4.3	0.16% (5th)	—	2026.1.5571	2026-03-17	4 versions
CVE-2026-12887US	—	—	—	no fix	2026-10-27	≤ Server <2026.3.15973
CVE-2026-117466US	—	—	—	no fix	2026-10-27	≤ Server <2026.3.15973
CVE-2026-117341US	—	—	—	no fix	2026-10-27	≤ Server <2026.3.15973
CVE-2026-116870US	—	—	—	no fix	2026-10-27	≤ Server <2026.3.15973

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-284Improper Access Control3 CVEs
CWE-863Incorrect Authorization3 CVEs
CWE-1289Improper Validation of Unsafe Equivalence in Input2 CVEs
CWE-532Insertion of Sensitive Information into Log File2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-862Missing Authorization2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan