octopus has 2 CVEs on record. 1 was published in the last 90 days. The median CVSS is 7.7 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-12878High· 8.8In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.48CVE-2026-4881Medium· 6.5In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.36
octopus vulnerabilities
CVEs affecting octopus, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-12878High· 8.8In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
▾ Twilightoctopus · codefreshEPSS 0.42%via NVD
CVE-2026-4881Medium· 6.5In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
▾ Sunlitoctopus · octopus_serverEPSS 0.21%via NVD