CVE-2026-55632 | Medium | 4.3 | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, en… |
CVE-2026-52744 | | | 2026-09-23 | GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstrea… |
CVE-2026-68919 | | | 2026-09-21 | GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic th… |
CVE-2026-55870 | | | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control… |
CVE-2026-55625 | Medium | 4.9 | 2026-09-21 | GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/i… |
CVE-2026-55060 | Low | 3.7 | 2026-09-21 | GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only autho… |
CVE-2026-52743 | Medium | 4.3 | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belong… |
CVE-2026-52742 | | | 2026-09-21 | GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline… |
CVE-2026-52741 | | | 2026-09-21 | GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenie… |
CVE-2026-52740 | | | 2026-09-21 | GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authoriza… |
CVE-2024-56324 | High | 7.1 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups… |
CVE-2024-56322 | High | 7.2 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (p… |
CVE-2024-56321 | Low | 3.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup scrip… |
CVE-2024-56320 | High | 8.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the… |
CVE-2024-28866 | Low | 3.1 | 2024-05-14 | GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site scripting vulnerabil… |
CVE-2023-28630 | Medium | 4.2 | 2023-03-27 | GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by admi… |
CVE-2023-28629 | Medium | 5.4 | 2023-03-27 | GoCD is an open source continuous delivery server. GoCD versions before 23.1.0 are vulnerable to a stored XSS vulnerability, where pipeline configuration with… |
CVE-2022-39311 | Critical | 9.1 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-39310 | Medium | 4.9 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-39309 | Medium | 4.9 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-39308 | Medium | 6.5 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-36088 | Medium | 5.0 | 2022-09-07 | GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permi… |
CVE-2022-29184 | High | 8.8 | 2022-05-20 | GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create… |
CVE-2022-29183 | Medium | 4.3 | 2022-05-20 | GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison f… |
CVE-2022-29182 | Medium | 4.3 | 2022-05-20 | GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based cross-site scripti… |
CVE-2022-24832 | High | 8.2 | 2022-04-11 | GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape specia… |