Skip to contentCockpit-hq Cockpit vulnerabilities
- cockpit-hq cockpitCockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/checkCVE-2026-1093796.9 Medium
- cockpit-hq cockpitCockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.phpCVE-2026-1052172.3 Low
- cockpit-hq cockpitCockpit CMS before 2.14.1 Account Enumeration via Auth TimingCVE-2026-824496.9 Medium
- cockpit-hq cockpitCockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.phpCVE-2026-584678.2 High
- cockpit-hq cockpitCockpit CMS 2.14.0 Stored XSS via Set Field Display TemplateCVE-2026-236955.1 Medium
- cockpit-hq cockpitCockpit-HQ Cockpit Asset Handler/Aggregate data query logic injectionCVE-2026-6626Fix available5.3 Medium
- agentejo cockpitCockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()CVE-2026-31891Public exploitFix available7.7 High
- agentejo cockpitCockpit save cross site scriptingCVE-2025-7053Fix available5.1 Medium
- cockpit-hq cockpit-hq/cockpitCockpit Arbitrary File UploadCVE-2025-1025Fix availableEPSS 21.2%8.7 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitCVE-2023-44516.1 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitCVE-2023-44338.3 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Reflected in cockpit-hq/cockpitCVE-2023-44328.3 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitCVE-2023-4422Fix available6.8 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitCVE-2023-43958.1 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitCVE-2023-43218.3 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreCross-site Scripting (XSS) - Stored in cockpit-hq/cockpitCVE-2023-4196Fix available8.3 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 morePHP Remote File Inclusion in cockpit-hq/cockpitCVE-2023-4195Fix available9.9 Critical
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreUnrestricted Upload of File with Dangerous Type in cockpit-hq/cockpitCVE-2023-1313Fix available7.2 High
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreUse of Platform-Dependent Third Party Components in cockpit-hq/cockpitCVE-2023-11604.0 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreImproper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpitCVE-2023-0780Fix available4.0 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 morePrivilege Chaining in cockpit-hq/cockpitCVE-2023-0759Fix available5.3 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpitCVE-2022-2818Fix available9.8 Critical
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreInsufficient Session Expiration in cockpit-hq/cockpitCVE-2022-2713Fix available8.6 High
- cockpit-hq cockpit, redhat enterprise linux +1 moreA flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate...CVE-2021-3698Fix available7.5 High
- cockpit-hq cockpit, redhat enterprise linux +1 moreCockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to...CVE-2021-3660Fix available4.3 Medium
- [unknown] cockpit, fedoraproject fedora, redhat virtualization +2 moreIt was found that cockpit before version 184 used glib's base64 decode functionality incorrectly...CVE-2019-3804Fix available7.5 High