Vulnerabilities

TI-2026-40159 CVE-2026-55632

GoCD is vulnerable to authorization bypass via pipeline structure API

LOW 20

GoCD is a continuous deliver server.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00402 Published 2026-09-23 Fixed in 26.1.0 CWE-863

TI-2026-37862 CVE-2026-52744

GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

LOW 25

GoCD is a continuous deliver server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00583 Published 2026-09-23 Fixed in 26.1.0 CWE-862

TI-2026-37860 CVE-2026-52742

GoCD is vulnerable to historical server configuration API authorization bypass

LOW 24

GoCD is a continuous deliver server.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0071 Published 2026-09-21 Fixed in 26.1.0 CWE-863

TI-2026-40327 CVE-2026-55870

GoCD is vulnerable to credential exposure when admins insecurely configure material URLs

LOW 13

GoCD is a continuous deliver server.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00583 Published 2026-09-21 Fixed in 26.1.0 CWE-200

TI-2026-40153 CVE-2026-55625

GoCD is vulnerable to authorization bypass via material connection test APIs

LOW 23

GoCD is a continuous deliver server.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00586 Published 2026-09-21 Fixed in 26.1.0 CWE-639

TI-2026-37858 CVE-2026-52740

GoCD is vulnerable to pipeline template view API authorization bypass

LOW 25

GoCD is a continuous deliver server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00583 Published 2026-09-21 Fixed in 26.1.0 CWE-863

TI-2026-39767 CVE-2026-55060

GoCD is vulnerable to authorization bypass via support process list API

LOW 18

GoCD is a continuous deliver server.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00413 Published 2026-09-21 Fixed in 26.1.0 CWE-863

TI-2026-37859 CVE-2026-52741

GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

LOW 34

GoCD is a continuous deliver server.

CVSS 4.0HIGH 7.5 Network Low privileges User interaction EPSS 0.00538 Published 2026-09-21 Fixed in 26.1.0 CWE-80

TI-2026-48459 CVE-2026-68919

GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages

LOW 31

GoCD is a continuous deliver server.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00483 Published 2026-09-21 Fixed in 26.1.0 CWE-80

TI-2026-37861 CVE-2026-52743

GoCD before 26.1.0 is vulnerable to authorization bypass via job status API

LOW 20

GoCD is a continuous deliver server.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00402 Published 2026-09-21 Fixed in 26.1.0 CWE-639

TI-2024-37285 CVE-2024-56324

GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins

LOW 13

GoCD is a continuous deliver server.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00806 Published 2025-01-03 Fixed in 24.5.0 CWE-611

TI-2024-37283 CVE-2024-56322

GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality

LOW 12

GoCD is a continuous deliver server.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.00723 Published 2025-01-03 Fixed in 24.5.0 CWE-611

TI-2024-37282 CVE-2024-56321

GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access

LOW 19

GoCD is a continuous deliver server.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00561 Published 2025-01-03 Fixed in 24.5.0 CWE-20

TI-2024-37281 CVE-2024-56320

GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user

MEDIUM 44

GoCD is a continuous deliver server.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00737 Published 2025-01-03 Fixed in 24.5.0 CWE-285

TI-2024-19065 CVE-2024-28866

GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up

LOW 28

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00419 Published 2024-05-13 Fixed in 24.1.0 CWE-79

TI-2021-09947 CVE-2021-29057 · GHSA-7vxc-q7rv-qfj8

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version…

MEDIUM 62

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00586 Published 2023-08-11 No fix listed CWE-400

TI-2023-13148 CVE-2023-28629

Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd

LOW 25

GoCD is an open source continuous delivery server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00498 Published 2023-03-27 Fixed in 23.1.0 CWE-79

TI-2023-13149 CVE-2023-28630

Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd

LOW 20

GoCD is an open source continuous delivery server.

CVSS 3.1MEDIUM 4.4 Local High privileges No interaction EPSS 0.00254 Published 2023-03-27 Fixed in 23.1.0 CWE-532

TI-2022-18687 CVE-2022-39311

Compromised agents may be able to execute remote code on GoCD Server

MEDIUM 46

GoCD is a continuous delivery server.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02216 Published 2022-10-14 Fixed in 21.1.0 CWE-502

TI-2022-18686 CVE-2022-39310

Malicious agent may be able to impersonate another agent in GoCD

LOW 30

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00859 Published 2022-10-14 Fixed in 21.1.0 CWE-284

TI-2022-18685 CVE-2022-39309

GoCD server secret encryption/decryption key leaked to agents during material serialization

LOW 31

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01064 Published 2022-10-14 Fixed in 21.1.0 CWE-200

TI-2022-18684 CVE-2022-39308

GoCD API authentication of user access tokens subject to timing attack during comparison

LOW 30

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00868 Published 2022-10-14 Fixed in 19.11.0 CWE-1254

TI-2022-16511 CVE-2022-36088

GoCD Windows installations outside default location inadequately restrict installation file permissions

LOW 24

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00231 Published 2022-09-07 Fixed in 22.2.0 CWE-269

TI-2022-11727 CVE-2022-29184

Command Injection/Argument Injection in GoCD

MEDIUM 46

GoCD is a continuous delivery server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03632 Published 2022-05-20 Fixed in 22.1.0 CWE-77

TI-2022-11726 CVE-2022-29183

Reflected XSS in GoCD

LOW 29

GoCD is a continuous delivery server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00872 Published 2022-05-20 Fixed in 21.4.0 CWE-79

Vulnerabilities

Filters