# cve.now: Gocd

The newest entries naming Gocd as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-55632](https://cve.now/CVE-2026-55632.md): GoCD is vulnerable to authorization bypass via pipeline structure API (CVSS 4.3)
- [CVE-2026-52744](https://cve.now/CVE-2026-52744.md): GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API (CVSS 5.3)
- [CVE-2026-52742](https://cve.now/CVE-2026-52742.md): GoCD is vulnerable to historical server configuration API authorization bypass (CVSS 5.1)
- [CVE-2026-55870](https://cve.now/CVE-2026-55870.md): GoCD is vulnerable to credential exposure when admins insecurely configure material URLs (CVSS 2.3)
- [CVE-2026-55625](https://cve.now/CVE-2026-55625.md): GoCD is vulnerable to authorization bypass via material connection test APIs (CVSS 4.9)
- [CVE-2026-52740](https://cve.now/CVE-2026-52740.md): GoCD is vulnerable to pipeline template view API authorization bypass (CVSS 5.3)
- [CVE-2026-55060](https://cve.now/CVE-2026-55060.md): GoCD is vulnerable to authorization bypass via support process list API (CVSS 3.7)
- [CVE-2026-52741](https://cve.now/CVE-2026-52741.md): GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages (CVSS 7.5)
- [CVE-2026-68919](https://cve.now/CVE-2026-68919.md): GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages (CVSS 7.0)
- [CVE-2026-52743](https://cve.now/CVE-2026-52743.md): GoCD before 26.1.0 is vulnerable to authorization bypass via job status API (CVSS 4.3)
- [CVE-2024-56324](https://cve.now/CVE-2024-56324.md): GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins (CVSS 2.1)
- [CVE-2024-56322](https://cve.now/CVE-2024-56322.md): GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality (CVSS 2.1)
- [CVE-2024-56321](https://cve.now/CVE-2024-56321.md): GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access (CVSS 3.8)
- [CVE-2024-56320](https://cve.now/CVE-2024-56320.md): GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user (CVSS 9.4)
- [CVE-2024-28866](https://cve.now/CVE-2024-28866.md): GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up (CVSS 3.1)
- [CVE-2023-28629](https://cve.now/CVE-2023-28629.md): Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd (CVSS 5.4)
- [CVE-2023-28630](https://cve.now/CVE-2023-28630.md): Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd (CVSS 4.2)
- [CVE-2022-39311](https://cve.now/CVE-2022-39311.md): Compromised agents may be able to execute remote code on GoCD Server (CVSS 9.1)
- [CVE-2022-39310](https://cve.now/CVE-2022-39310.md): Malicious agent may be able to impersonate another agent in GoCD (CVSS 4.9)
- [CVE-2022-39309](https://cve.now/CVE-2022-39309.md): GoCD server secret encryption/decryption key leaked to agents during material serialization (CVSS 4.9)
- [CVE-2022-39308](https://cve.now/CVE-2022-39308.md): GoCD API authentication of user access tokens subject to timing attack during comparison (CVSS 6.5)
- [CVE-2022-36088](https://cve.now/CVE-2022-36088.md): GoCD Windows installations outside default location inadequately restrict installation file permissions (CVSS 5.0)
- [CVE-2022-29184](https://cve.now/CVE-2022-29184.md): Command Injection/Argument Injection in GoCD (CVSS 8.8)
- [CVE-2022-29183](https://cve.now/CVE-2022-29183.md): Reflected XSS in GoCD (CVSS 4.3)
- [CVE-2022-29182](https://cve.now/CVE-2022-29182.md): DOM-based XSS in GoCD (CVSS 4.3)
- [CVE-2022-24832](https://cve.now/CVE-2022-24832.md): Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames (CVSS 8.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/gocd
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.