Aggregating NVD, CVE, and multi-source threat feeds, this list provides deep analysis of high-risk threats such as RCE. By integrating CVSS and EPSS models, the system dynamically tracks Exp (Exploit) resources and PoC availability to accurately assess Exploitability. Combined with official Patches and remediation strategies, it helps prioritize Vulnerability Management workflows, significantly shortening response cycles and securing your critical assets.
Assigner (CNA / source)：[email protected] Remove this filter
| CVE | Description | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|
| CVE-2021-31819 | In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification. | 9.8 | 2.28% | 2021-09-21 | 2026-06-16 |
| CVE-2022-2883 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service | 7.5 | 1.01% | 2023-02-21 | 2026-06-17 |
| CVE-2021-31817 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext. | 7.5 | 0.86% | 2021-07-08 | 2026-06-16 |
| CVE-2021-31816 | When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext. | 7.5 | 0.86% | 2021-07-08 | 2026-06-16 |
| CVE-2022-2013 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have access to the Script Console within their private space. | 7.5 | 0.83% | 2022-06-12 | 2026-06-17 |
| CVE-2022-1670 | When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users. | 7.5 | 0.78% | 2022-05-19 | 2026-06-17 |
| CVE-2022-2778 | In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. | 9.8 | 0.74% | 2022-09-30 | 2026-06-17 |
| CVE-2022-4009 | In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation | 8.8 | 0.72% | 2023-03-16 | 2026-06-17 |
| CVE-2022-2074 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. | 7.5 | 0.72% | 2022-08-19 | 2026-06-17 |
| CVE-2022-2572 | In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still valid after the access was revoked. | 9.8 | 0.71% | 2022-10-31 | 2026-06-17 |
| CVE-2022-2075 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. | 7.5 | 0.66% | 2022-08-19 | 2026-06-17 |
| CVE-2022-2049 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. | 7.5 | 0.66% | 2022-08-19 | 2026-06-17 |
| CVE-2021-31818 | Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables. | 4.3 | 0.62% | 2021-06-17 | 2026-06-16 |
| CVE-2021-31820 | In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI. | 7.5 | 0.61% | 2021-08-18 | 2026-06-16 |
| CVE-2022-3460 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. | 7.5 | 0.56% | 2023-01-02 | 2026-06-17 |
| CVE-2022-2721 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled. | 7.5 | 0.56% | 2022-11-25 | 2026-06-17 |
| CVE-2022-23184 | In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. | 6.1 | 0.55% | 2022-02-06 | 2026-06-17 |
| CVE-2022-2782 | In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. | 9.1 | 0.53% | 2022-10-27 | 2026-06-17 |
| CVE-2022-2828 | In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability | 6.5 | 0.53% | 2022-10-13 | 2026-06-17 |
| CVE-2022-2508 | In affected versions of Octopus Server it is possible to reveal the existence of resources in a space that the user does not have access to due to verbose error messaging. | 5.3 | 0.51% | 2022-10-27 | 2026-06-17 |