gocd

Products

Exploited and recent CVEs

• CVE-2026-55632 Medium 4.3 GoCD is vulnerable to authorization bypass via pipeline structure API 0.4%
• CVE-2026-52744 Medium 5.3 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API 0.6%
• CVE-2026-52742 Medium 5.1 GoCD is vulnerable to historical server configuration API authorization bypass 0.7%
• CVE-2026-55870 Low 2.3 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs 0.6%
• CVE-2026-55625 Medium 4.9 GoCD is vulnerable to authorization bypass via material connection test APIs 0.6%
• CVE-2026-52740 Medium 5.3 GoCD is vulnerable to pipeline template view API authorization bypass 0.6%
• CVE-2026-55060 Low 3.7 GoCD is vulnerable to authorization bypass via support process list API 0.4%
• CVE-2026-52741 High 7.5 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages 0.5%
• CVE-2026-68919 High 7.0 GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages 0.5%
• CVE-2026-52743 Medium 4.3 GoCD before 26.1.0 is vulnerable to authorization bypass via job status API 0.4%
• CVE-2024-56324 Low 2.1 GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins 0.8%
• CVE-2024-56322 Low 2.1 GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality 0.7%
• CVE-2024-56321 Low 3.8 GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access 0.6%
• CVE-2024-56320 Critical 9.4 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user 0.7%
• CVE-2024-28866 Low 3.1 GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up 0.4%
• CVE-2023-28629 Medium 5.4 Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd 0.5%
• CVE-2023-28630 Medium 4.2 Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd 0.3%
• CVE-2022-39311 Critical 9.1 Compromised agents may be able to execute remote code on GoCD Server 2.2%
• CVE-2022-39308 Medium 6.5 GoCD API authentication of user access tokens subject to timing attack during comparison 0.9%
• CVE-2022-39309 Medium 4.9 GoCD server secret encryption/decryption key leaked to agents during material serialization 1.1%
• CVE-2022-39310 Medium 4.9 Malicious agent may be able to impersonate another agent in GoCD 0.9%
• CVE-2022-36088 Medium 5.0 GoCD Windows installations outside default location inadequately restrict installation file permissions 0.2%
• CVE-2022-29184 High 8.8 Command Injection/Argument Injection in GoCD 3.6%
• CVE-2022-29183 Medium 4.3 Reflected XSS in GoCD 0.9%
• CVE-2022-29182 Medium 4.3 DOM-based XSS in GoCD 0.9%
• CVE-2022-24832 High 8.2 Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames 1.7%