https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-56324.htmlhttps://patchthecve.com/cve/CVE-2024-56324.htmlWed, 17 Jun 2026 08:12:02 +0000HIGH 7.1: GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups they administer to trigger XML External Entity (XXE) injection on the GoCD server. Theoretically, the XXE vulnerability can result in additiohttps://patchthecve.com/cve/CVE-2024-56322.htmlhttps://patchthecve.com/cve/CVE-2024-56322.htmlWed, 17 Jun 2026 08:12:02 +0000HIGH 7.2: GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (pipelines as code) feature to allow XML External Entity (XXE) injection on the GoCD Server which will be executed when GoCD periodically scanshttps://patchthecve.com/cve/CVE-2024-56321.htmlhttps://patchthecve.com/cve/CVE-2024-56321.htmlWed, 17 Jun 2026 08:12:02 +0000LOW 3.8: GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. Inhttps://patchthecve.com/cve/CVE-2024-56320.htmlhttps://patchthecve.com/cve/CVE-2024-56320.htmlWed, 17 Jun 2026 08:12:02 +0000HIGH 8.8: GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authenticated GoCD user with an existing GoCD user