{"id":"CVE-2026-4802","aliases":["ALSA-2026:21468","ALSA-2026:21676","ALSA-2026:21700","CLSA-2026-1780323631","CLSA-2026-1781091230","DEBIAN-CVE-2026-4802","EUVD-2026-29051","GHSA-3wjm-5g86-c6p3","MGASA-2026-0175","OESA-2026-2907","OESA-2026-2908","OESA-2026-3098","RHSA-2026:21390","RHSA-2026:21392","RHSA-2026:21394","RHSA-2026:21395","RHSA-2026:21468","RHSA-2026:21515","RHSA-2026:21516","RHSA-2026:21647","RHSA-2026:21676","RHSA-2026:21700","RLSA-2026:21468","RLSA-2026:21676","RLSA-2026:21700","SUSE-SU-2026:2005-1","SUSE-SU-2026:2019-1","SUSE-SU-2026:21785-1","SUSE-SU-2026:21872-1","SUSE-SU-2026:22770-1","SUSE-SU-2026:22837-1","SUSE-SU-2026:2363-1","UBUNTU-CVE-2026-4802","openSUSE-SU-2026:10819-1","openSUSE-SU-2026:21208-1","openSUSE-SU-2026:21399-1"],"status":"published","title":"Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01016,"percentile":0.63538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2026-05-11T12:48:08Z","modified":"2026-11-05T10:01:14Z","exploits":[{"source":"pocgithub","id":"hakaioffsec/CVE-2026-4802","title":"hakaioffsec/CVE-2026-4802","date":"2026-05-11","url":"https://github.com/hakaioffsec/CVE-2026-4802"}],"fixes":[{"ecosystem":"AlmaLinux:9","package":"cockpit","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-bridge","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-doc","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-packagekit","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-storaged","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-system","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-ws","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-ws-selinux","fixed_in":["356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-bridge","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-doc","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-packagekit","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-storaged","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-system","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-ws","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"cockpit-ws-selinux","fixed_in":["356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit","fixed_in":["310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-bridge","fixed_in":["310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-doc","fixed_in":["310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-system","fixed_in":["310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-ws","fixed_in":["310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-bridge","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-doc","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-packagekit","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-storaged","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-system","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-ws","fixed_in":["334.2-1.el9_6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cockpit","fixed_in":["337-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cockpit","fixed_in":["362-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-packagekit","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-storaged","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-bridge","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-debuginfo","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-debugsource","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-doc","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-system","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-ws","fixed_in":["0:334.2-1.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"cockpit-packagekit","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"cockpit-storaged","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-bridge","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-debuginfo","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-debugsource","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-doc","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-system","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-ws","fixed_in":["0:334.3-1.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-debuginfo","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-debugsource","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-packagekit","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-pcp","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-storaged","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-bridge","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-debuginfo","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-debugsource","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-doc","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-system","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-ws","fixed_in":["0:286.3-1.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-debuginfo","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-debugsource","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-packagekit","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-pcp","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-storaged","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-bridge","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-debuginfo","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-debugsource","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-doc","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-system","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-ws","fixed_in":["0:264.3-1.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-packagekit","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-storaged","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-bridge","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debuginfo","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debugsource","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-doc","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-system","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws-selinux","fixed_in":["0:356.2-1.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-bridge","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-debuginfo","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-debugsource","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-doc","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-system","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-ws","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-bridge","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-debuginfo","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-debugsource","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-doc","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-system","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-ws","fixed_in":["0:286.2-1.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-bridge","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-debuginfo","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-debugsource","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-doc","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-system","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-ws","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-bridge","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-debuginfo","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-debugsource","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-doc","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-system","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-ws","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-bridge","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-debuginfo","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-debugsource","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-doc","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-system","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-ws","fixed_in":["0:264.3-1.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-debuginfo","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-debugsource","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-packagekit","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-pcp","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-storaged","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-bridge","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-debuginfo","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-debugsource","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-doc","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-system","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-ws","fixed_in":["0:311.3-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-packagekit","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-storaged","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-bridge","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-debuginfo","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-debugsource","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-doc","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-system","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-ws","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-ws-selinux","fixed_in":["0:356.2-1.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-bridge","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debuginfo","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debugsource","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-doc","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-system","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-ws","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"cockpit","fixed_in":["0:356.2-1.el9_8.rocky.0.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"cockpit","fixed_in":["0:356.2-1.el10_2.rocky.0.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cockpit","fixed_in":["0:310.8-1.el8_10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cockpit","fixed_in":["361-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"cockpit","fixed_in":["354-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334.2-1.el9_6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["287-1","287.1-0+deb12u1","287.1-0+deb12u2","287.1-0+deb12u3","288.1-1","289-1","290-1","291-1","292-1","293-1","294-1","294.1-1","295-1","296-1","297-1","297-1~bpo12+1","298-1","299-1","299-1~bpo12+1","300-1","300.1-1","300.1-1~bpo12+1","301-1","301-1~bpo12+1","302-1","303-1","303-1~bpo12+1","304-1","305-1","305-1~bpo12+1","306-1","306-1~bpo12+1","307-1","307-1~bpo12+1","308-1","308-1~bpo12+1","309-1","309-1~bpo12+1","310-1","310.1-1","310.1-1~bpo12+1","311-1","311-1~bpo12+1","312-1","313-1","314-1","316-1","317-1","317-2","317-3","317-4","317-5","318-1","318-2","318-3","318-4","318-4~bpo12+1","319-1","319-1~bpo12+1","320-1","320-1~bpo12+1","321-1","322-1","322-1~bpo12+1","323-1","323-1~bpo12+1","324-1","324-1~bpo12+1","325-1","325-1~bpo12+1","326-1","327-1","327-1~bpo12+1","328-1","329-1","329-1~bpo12+1","330-1","330-2","330-3","330-4","331-1","331-1~bpo12+1","332-1","333-1","333-1~bpo12+1","334-1","335-1","335-2","335-2~bpo12+1","336-1","337-1","337-1~bpo12+1","338-1","339-1","340-1","341.1-1","342-1","343-1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","352-1","352-1~bpo13+1","353.1-1","353.1-1~bpo13+1","354-1","354-1~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","358-1","358-1~bpo13+1","360-1","360-1~bpo13+1","362-1","362-1~bpo13+1","365-1","365-1~bpo13+1","366-1","366-1~bpo13+1","367-1","367-1~bpo13+1","368-1","368-1~bpo13+1","370-1","370-1~bpo13+1","371-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"337-1+deb13u2"}]}],"versions":["337-1","337-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"362-1"}]}],"versions":["337-1","338-1","339-1","340-1","341.1-1","342-1","343-1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","352-1","352-1~bpo13+1","353.1-1","353.1-1~bpo13+1","354-1","354-1~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","358-1","358-1~bpo13+1","360-1","360-1~bpo13+1","362-1~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"356.2-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-8.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-8.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-9.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.2-1.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:334.3-1.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.3-1.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:286.2-1.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.3-1.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.3-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el9_8.rocky.0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.2-1.el10_2.rocky.0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.8-1.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"298-150500.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["151-1","156-1","157-1","158-1","160-1","161-1","162-1","163-1","164-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["202.1-1","204-1","206-1","207-1","208-1","210-1","211-1","212-1","213-1","214.1-1","215-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["252-1","256-1","257-1","258-1","259-1","260-1","261-1","262-1","263-1","264-1","264-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["300.1-1","303-1","304-1","305-1","306-1","307-1","308-1","309-1","310.1-1","311-1","312-1build2","314-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["333-1","337-1","339-1","342-1","343-1","345-1","346-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["360-1","362-1","365-1","367-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["346-1","348-1","350-1","352-1","353.1-1","354-1","355-1","356-1","360-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"361-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-repos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cockpit-subscriptions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:21390","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21392","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21394","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21395","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21468","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21515","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21516","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21647","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21676","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21700","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4802","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451155","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/cockpit-project/cockpit/blob/e204cd130/pkg/systemd/logsJournal.jsx#L206-L210","tags":["article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/20/19"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4802.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4802","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3wjm-5g86-c6p3","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2451155","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-21468.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-21676.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-21700.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780323631.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781091230.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6126","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4802","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0175.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35563","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/20/19","tags":["web","report"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/339","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/340","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/341","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/341.1","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/342","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/343","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/344","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/345","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/346","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/347","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/348","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/349","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/350","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/351","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/352","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/353","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/353.1","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/354","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/355","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/356","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/356.1","tags":["web"]},{"url":"https://github.com/cockpit-project/cockpit/releases/tag/356.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rq49-h582-83m7","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2947","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2908","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3098","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21390.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4802","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21392.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21394.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21395.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21468.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21515.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21516.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21647.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21676.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-171012","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21700.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21468","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21676","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21700","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256521","tags":["report"]},{"url":"https://bugzilla.suse.com/1259290","tags":["report"]},{"url":"https://bugzilla.suse.com/1265040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4802","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262019-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621785-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257836","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621872-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622770-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236149","tags":["report"]},{"url":"https://bugzilla.suse.com/1257033","tags":["report"]},{"url":"https://bugzilla.suse.com/1257325","tags":["report"]},{"url":"https://bugzilla.suse.com/1257698","tags":["report"]},{"url":"https://bugzilla.suse.com/1257838","tags":["report"]},{"url":"https://bugzilla.suse.com/1257840","tags":["report"]},{"url":"https://bugzilla.suse.com/1258040","tags":["report"]},{"url":"https://bugzilla.suse.com/1258637","tags":["report"]},{"url":"https://bugzilla.suse.com/1258640","tags":["report"]},{"url":"https://bugzilla.suse.com/1258641","tags":["report"]},{"url":"https://bugzilla.suse.com/1259010","tags":["report"]},{"url":"https://bugzilla.suse.com/1259013","tags":["report"]},{"url":"https://bugzilla.suse.com/1259015","tags":["report"]},{"url":"https://bugzilla.suse.com/1259210","tags":["report"]},{"url":"https://bugzilla.suse.com/1259774","tags":["report"]},{"url":"https://bugzilla.suse.com/1261829","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4631","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622837-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258900","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27606","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-4802","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-4802","title":"Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","status":"published","published":"2026-05-11T12:48:08.657Z","modified":"2026-11-04T22:41:51.106Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78","CWE-78"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-29051","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","status":"published","published":"2026-05-11T12:48:08Z","modified":"2026-11-04T22:41:51Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-3wjm-5g86-c6p3","title":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary...","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","status":"published","published":"2026-05-11T15:32:12Z","modified":"2026-06-30T03:36:38Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:09:04.668745Z"}],"nvd":[{"id":"CVE-2026-4802","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","status":"published","published":"2026-05-11T14:16:31.55Z","modified":"2026-11-04T23:17:38.973Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-05T01:45:09.958441Z"}],"osv":[{"id":"DEBIAN-CVE-2026-4802","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","status":"published","published":"2026-05-11T14:16:31.55Z","modified":"2026-11-05T10:01:14.413920027Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"OESA-2026-2907","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)\n\nA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.175413885Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2908","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)\n\nA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.209260939Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3098","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)\n\nA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)","status":"published","published":"2026-07-19T11:11:59Z","modified":"2026-08-18T01:21:21.165335952Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:21390","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:45Z","modified":"2026-10-14T10:15:32Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21392","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-29T10:10:50Z","modified":"2026-10-14T10:15:32Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21394","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:46Z","modified":"2026-10-14T10:15:33Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21395","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:47Z","modified":"2026-10-14T10:15:33Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21468","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:49Z","modified":"2026-10-14T10:15:34Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21515","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:50Z","modified":"2026-10-14T10:15:34Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21516","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:50Z","modified":"2026-10-14T10:15:35Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21647","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-28T10:07:53Z","modified":"2026-10-14T10:15:35Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21676","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-29T10:10:56Z","modified":"2026-10-14T10:15:36Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21700","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2026-05-29T10:10:58Z","modified":"2026-06-30T10:42:36Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2026:21468","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-30T18:03:01.190443Z","modified":"2026-05-30T18:25:44.602500272Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:21676","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-04T12:04:37.164871Z","modified":"2026-06-04T12:30:18.453546247Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:21700","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It\noffers network configuration, log inspection, diagnostic reports, SELinux\ntroubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: Cockpit: Arbitrary command execution via crafted links in system logs\nUI (CVE-2026-4802)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.","status":"published","published":"2026-05-29T06:00:38.1136Z","modified":"2026-05-29T06:30:04.77861059Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-4802","description":"A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.","status":"published","published":"2026-05-11T14:16:00Z","modified":"2026-10-17T13:00:22.372176854Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ALSA-2026:21468","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  \n\nSecurity Fix(es):  \n\n  * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-10-29T11:32:32.215670075Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:21676","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.  \n\nSecurity Fix(es):  \n\n  * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-10-29T11:30:23.397721756Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:21700","title":"Important: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It  \noffers network configuration, log inspection, diagnostic reports, SELinux  \ntroubleshooting, interactive command-line sessions, and more.  \n\nSecurity Fix(es):  \n\n  * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs\n\n\nUI (CVE-2026-4802)  \n\nFor more details about the security issue(s), including the impact, a CVSS  \nscore, acknowledgments, and other related information, refer to the CVE page(s)  \nlisted in the References section.\n","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-10-29T11:02:23.634187196Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1780323631","title":"cockpit: Fix of CVE-2026-4802","description":"- CVE-2026-4802: fix arbitrary command execution via crafted links in the system logs UI","status":"published","published":"2026-06-01T14:21:16Z","modified":"2026-10-26T09:31:05.639326092Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1781091230","title":"cockpit: Fix of 2 CVEs","description":"- CVE-2026-4802: fix shell command injection via boot descriptor query string in\n  the system logs page by quoting journalctl arguments using shlex-style single-\n  quote escaping\n\n- CVE-2024-6126: fix insecure killing of session ssh-agent; include upstream\n  follow-up commit for proper strtoul() error handling when parsing SSH_AGENT_PID","status":"published","published":"2026-10-06T17:11:01Z","modified":"2026-10-26T09:43:58.332976575Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"MGASA-2026-0175","title":"Updated cockpit packages fix security vulnerabilities","description":"CVE-2026-4631, Cockpit's remote login feature passes user-supplied\nhostnames and usernames from the web interface to the SSH client without\nvalidation or sanitization. An attacker with network access to the\nCockpit web service can craft a single HTTP request to the login\nendpoint that injects malicious SSH options or shell commands, achieving\ncode execution on the Cockpit host without valid credentials. The\ninjection occurs during the authentication flow before any credential\nverification takes place, meaning no login is required to exploit the\nvulnerability.\nCVE-2026-4800, lodash vulnerable to Code Injection via `_.template`\nimports key names\nCVE-2026-4802, A flaw was found in Cockpit. This vulnerability allows a\nremote attacker to achieve arbitrary command execution on the host by\nexploiting unsanitized user-controlled parameters within crafted links\nin the system logs user interface (UI). An attacker can inject shell\nmetacharacters and command substitutions into these parameters, leading\nto the execution of arbitrary shell commands on the affected system.\nThis could result in a complete system compromise.\n","status":"published","published":"2026-06-05T17:37:45Z","modified":"2026-06-05T18:03:34.31879047Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10819-1","title":"cockpit-361-1.1 on GA media","description":"These are all security issues fixed in the cockpit-361-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-05-21T08:15:08.300980002Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21208-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issue\n\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n","status":"published","published":"2026-07-02T07:07:46Z","modified":"2026-07-03T11:00:06.792615221Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21399-1","title":"Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions","description":"This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from\n  global prototypes (bsc#1257325).\n- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).\n\nNon security issues fixed:\n\n- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).\n- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).\n\nChanges for cockpit:\n\n- Update to 364.\n\n- Update to 361 (jsc#PED-15706/jsc#CPT-183):\n\n * Remove all \"Mount\" actions in Anaconda mode\n * Dependency updates\n\n- Update to 360:\n * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631\n * ws: support loading a custom login page\n\n- Update to 358:\n\n * Networking: Add Wi-Fi support\n * Cockpit Client updated to GTK 4\n * Bugfixes and translation updates\n\n- Update to 357:\n\n * lib: Use browser context menu on shift\n * bridge: support Python 3.14 on old kernels (RHEL 8)\n\n- Update to 356:\n\n * systemd: Allow editing timers created by Cockpit\n * Convert license headers to SPDX format\n\n- Update to 355:\n\n * ws: Remove obsolete pam_cockpit_cert module\n * shell: add StartTransientUnit as a sudo alternative\n\nChanges for cockpit-machines:\n\n- Update to 354.\n\n- Update to 352:\n\n - Improvements to the \"Add disk\" and \"Create Volume\" dialogs.\n\n- Update suse_version requirement to function with the planned bump (jsc#PED-15820).\n- Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).\n\n- Update to 348:\n\n * Translation updates\n * Convert license headers to SPDX format\n * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl\n\n- Update to 347:\n * Bug fixes and translation updates\n\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-packages:\n\n- Update to version 5:\n\n * Support transactional systems\n * Improve error/success messages\n * Translation updates\n\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-podman:\n\n- Update to 128.\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-repos:\n\n- Update to 4.8.\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-subscriptions:\n\n- Update to version 16.2 (bsc#1257033).\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n","status":"published","published":"2026-07-21T15:45:48Z","modified":"2026-07-24T18:24:25.081526809Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2005-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues\n\n- CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and\n  arbitrary code execution in the context of a target user (bsc#1256521).\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n- CVE-2026-29074: svgo: no guard against entity expansion or recursion when processing XML with custom entities can lead\n  to DoS (bsc#1259290).\n","status":"published","published":"2026-05-19T08:23:18Z","modified":"2026-05-20T08:00:08.280081307Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2019-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues\n\n- CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and\n  arbitrary code execution in the context of a target user (bsc#1256521).\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n- CVE-2026-29074: svgo: no guard against entity expansion or recursion when processing XML with custom entities can lead\n  to DoS (bsc#1259290).\n","status":"published","published":"2026-05-20T07:13:11Z","modified":"2026-05-21T08:15:04.323177467Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21785-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues\n\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n","status":"published","published":"2026-05-22T09:42:26Z","modified":"2026-05-28T18:24:07.112208092Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21872-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issue\n\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n","status":"published","published":"2026-05-26T11:53:51Z","modified":"2026-06-03T18:24:39.335256629Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22770-1","title":"Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions","description":"This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from\n  global prototypes (bsc#1257325).\n- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).\n\nNon security issues fixed:\n\n- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).\n- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).\n\nChanges for cockpit:\n\n- Update to 364.\n\n- Update to 361 (jsc#PED-15706/jsc#CPT-183):\n\n * Remove all \"Mount\" actions in Anaconda mode\n * Dependency updates\n\n- Update to 360:\n * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631\n * ws: support loading a custom login page\n\n- Update to 358:\n\n * Networking: Add Wi-Fi support\n * Cockpit Client updated to GTK 4\n * Bugfixes and translation updates\n\n- Update to 357:\n\n * lib: Use browser context menu on shift\n * bridge: support Python 3.14 on old kernels (RHEL 8)\n\n- Update to 356:\n\n * systemd: Allow editing timers created by Cockpit\n * Convert license headers to SPDX format\n\n- Update to 355:\n\n * ws: Remove obsolete pam_cockpit_cert module\n * shell: add StartTransientUnit as a sudo alternative\n\nChanges for cockpit-machines:\n\n- Update to 354.\n\n- Update to 352:\n\n - Improvements to the \"Add disk\" and \"Create Volume\" dialogs.\n\n- Update suse_version requirement to function with the planned bump (jsc#PED-15820).\n- Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).\n\n- Update to 348:\n\n * Translation updates\n * Convert license headers to SPDX format\n * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl\n\n- Update to 347:\n * Bug fixes and translation updates\n\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-packages:\n\n- Update to version 5:\n\n * Support transactional systems\n * Improve error/success messages\n * Translation updates\n\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-podman:\n\n- Update to 128.\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-repos:\n\n- Update to 4.8.\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-subscriptions:\n\n- Update to version 16.2 (bsc#1257033).\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n","status":"published","published":"2026-07-21T16:05:47Z","modified":"2026-07-23T18:24:20.970797039Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22837-1","title":"Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions","description":"This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from\n  global prototypes (bsc#1257325).\n- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).\n\nNon security issues fixed:\n\n- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).\n- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).\n\nChanges for cockpit:\n\n- Update to 364.\n\n- Update to 361 (jsc#PED-15706/jsc#CPT-183):\n\n * Remove all \"Mount\" actions in Anaconda mode\n * Dependency updates\n\n- Update to 360:\n * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631\n * ws: support loading a custom login page\n\n- Update to 358:\n\n * Networking: Add Wi-Fi support\n * Cockpit Client updated to GTK 4\n * Bugfixes and translation updates\n\n- Update to 357:\n\n * lib: Use browser context menu on shift\n * bridge: support Python 3.14 on old kernels (RHEL 8)\n\n- Update to 356:\n\n * systemd: Allow editing timers created by Cockpit\n * Convert license headers to SPDX format\n\n- Update to 355:\n\n * ws: Remove obsolete pam_cockpit_cert module\n * shell: add StartTransientUnit as a sudo alternative\n\nChanges for cockpit-machines:\n\n- Update to 354.\n\n- Update to 352:\n\n - Improvements to the \"Add disk\" and \"Create Volume\" dialogs.\n\n- Update suse_version requirement to function with the planned bump (jsc#PED-15820).\n- Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).\n\n- Update to 348:\n\n * Translation updates\n * Convert license headers to SPDX format\n * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl\n\n- Update to 347:\n * Bug fixes and translation updates\n\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-packages:\n\n- Update to version 5:\n\n * Support transactional systems\n * Improve error/success messages\n * Translation updates\n\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-podman:\n\n- Update to 128.\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-repos:\n\n- Update to 4.8.\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-subscriptions:\n\n- Update to version 16.2 (bsc#1257033).\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n","status":"published","published":"2026-07-21T16:05:47Z","modified":"2026-07-28T18:24:09.137480038Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2363-1","title":"Security update for cockpit","description":"This update for cockpit fixes the following issues\n\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257838).\n- CVE-2026-27606: rollup: Arbitrary File Write via Path Traversal in Rollup 4 (bsc#1258900).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259015).\n","status":"published","published":"2026-06-11T06:54:18Z","modified":"2026-06-12T08:45:05.890005047Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}