CVE-2026-8296

MediumCVSS 5.6/10Last modified Oct 26, 2026

Description

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.

Metrics

CVSS 4.0 5.6/10CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Octopus DeployOctopus Server>= 2023.0.0, < 2025.4.10678; >= 2026.1.0, < 2026.1.11451; >= 2026.2.0, < 2026.2.13114

References

Timeline

Published
Jun 19, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-829608.8Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms CVE-2026-829617.8The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_CVE-2026-829626.5ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of theCVE-2026-829648.8Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker CVE-2026-829657.5A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact ResolutioCVE-2026-829679.8IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-baseCVE-2026-829686.4A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider acCVE-2026-829695.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBCVE-2026-82979.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering ConsultingCVE-2026-8297010.0Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows UsCVE-2026-8297110.0A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of theCVE-2026-829739.4Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticate
CVE-2026-8296: Medium severity, CVSS 5.6 | Vulnix