Cockpit-hq vulnerabilities

Products

• Cockpit 19
• Cockpit-hq/cockpit 15

Newest

• cockpit-hq cockpit Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check CVE-2026-109379 6.9 MediumOctober 12, 2026
• cockpit-hq cockpit Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php CVE-2026-105217 2.3 LowOctober 4, 2026
• cockpit-hq cockpit Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing CVE-2026-82449 6.9 MediumAugust 29, 2026
• cockpit-hq cockpit Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php CVE-2026-58467 8.2 HighJuly 2, 2026
• cockpit-hq cockpit Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template CVE-2026-23695 5.1 MediumMay 15, 2026
• cockpit-hq cockpit Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection CVE-2026-6626 Fix available 5.3 MediumApril 20, 2026
• agentejo cockpit Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() CVE-2026-31891 Public exploitFix available 7.7 HighMarch 17, 2026
• agentejo cockpit Cockpit save cross site scripting CVE-2025-7053 Fix available 5.1 MediumJuly 4, 2025
• cockpit-hq cockpit-hq/cockpit Cockpit Arbitrary File Upload CVE-2025-1025 Fix available EPSS 18.9% 8.7 HighFebruary 5, 2025
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit CVE-2023-4451 6.1 MediumAugust 20, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit CVE-2023-4433 8.3 HighAugust 19, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit CVE-2023-4432 8.3 HighAugust 19, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit CVE-2023-4422 Fix available 6.8 MediumAugust 18, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit CVE-2023-4395 8.1 HighAugust 17, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit CVE-2023-4321 8.3 HighAugust 14, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit CVE-2023-4196 Fix available 8.3 HighAugust 6, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more PHP Remote File Inclusion in cockpit-hq/cockpit CVE-2023-4195 Fix available 9.9 CriticalAugust 6, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit CVE-2023-1313 Fix available 7.2 HighMarch 10, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit CVE-2023-1160 4.0 MediumMarch 3, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit CVE-2023-0780 Fix available 4.0 MediumFebruary 11, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Privilege Chaining in cockpit-hq/cockpit CVE-2023-0759 Fix available 5.3 MediumFebruary 9, 2023
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit CVE-2022-2818 Fix available 9.8 CriticalAugust 15, 2022
• agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 more Insufficient Session Expiration in cockpit-hq/cockpit CVE-2022-2713 Fix available 8.6 HighAugust 8, 2022
• cockpit-hq cockpit, redhat enterprise linux +1 more A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate... CVE-2021-3698 Fix available 7.5 HighMarch 8, 2022
• cockpit-hq cockpit, redhat enterprise linux +1 more Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to... CVE-2021-3660 Fix available 4.3 MediumSeptember 30, 2021
• [unknown] cockpit, fedoraproject fedora, redhat virtualization +2 more It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly... CVE-2019-3804 Fix available 7.5 HighMarch 26, 2019