NVD や CVE、ほか複数の脅威フィードを束ね、RCE など高リスクな事象を深く追える一覧です。CVSS と EPSS を組み合わせ、Exploit 参照や PoC の有無から悪用しやすさを追跡します。ベンダー修正や緩和策の文脈とあわせて優先度を決め、対応サイクルを短く保ちつつ重要資産を守る支援をします。
Assigner（CNA／発行元）：[email protected] この条件を外す
| CVE | 説明 | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|
| CVE-2022-2778 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. | 9.8 | 0.74% | 2022-09-30 | 2026-06-17 |
| CVE-2022-2572 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked. | 9.8 | 0.83% | 2022-10-31 | 2026-06-17 |
| CVE-2021-31819 | In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification. | 9.8 | 2.28% | 2021-09-21 | 2026-06-16 |
| CVE-2022-2782 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. | 9.1 | 0.53% | 2022-10-27 | 2026-06-17 |
| CVE-2024-2975 | A race condition was identified through which privilege escalation was possible in certain configurations. | 8.8 | 0.41% | 2024-04-08 | 2026-06-17 |
| CVE-2022-4009 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation | 8.8 | 0.72% | 2023-03-16 | 2026-06-17 |
| CVE-2024-9194 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766. | 8.7 | 0.42% | 2024-09-30 | 2026-06-17 |
| CVE-2022-2780 | In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack. | 8.1 | 0.51% | 2022-10-14 | 2026-06-17 |
| CVE-2021-31822 | When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a local unprivileged user modifying the contents of the systemd service file to gain privileged access. | 7.8 | 0.21% | 2021-11-24 | 2026-06-16 |
| CVE-2021-26557 | When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access. | 7.8 | 0.31% | 2021-10-06 | 2026-06-16 |
| CVE-2021-26556 | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access. | 7.8 | 0.25% | 2021-10-06 | 2026-06-16 |
| CVE-2022-3460 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. | 7.5 | 0.56% | 2023-01-02 | 2026-06-17 |
| CVE-2022-2883 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | 7.5 | 1.01% | 2023-02-21 | 2026-06-17 |
| CVE-2022-2721 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled. | 7.5 | 0.56% | 2022-11-25 | 2026-06-17 |
| CVE-2022-2075 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. | 7.5 | 0.66% | 2022-08-19 | 2026-06-17 |
| CVE-2022-2074 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. | 7.5 | 0.72% | 2022-08-19 | 2026-06-17 |
| CVE-2022-2049 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. | 7.5 | 0.66% | 2022-08-19 | 2026-06-17 |
| CVE-2022-2013 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space. | 7.5 | 0.83% | 2022-06-12 | 2026-06-17 |
| CVE-2022-1670 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users. | 7.5 | 0.78% | 2022-05-19 | 2026-06-17 |
| CVE-2021-31820 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI. | 7.5 | 0.61% | 2021-08-18 | 2026-06-16 |