TI-2026-20077 CVE-2026-24892
openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling
Priority HIGH 73
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus.
openITCOCKPIT
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
openITCOCKPIT records in CISA KEVNo openITCOCKPIT vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records
TI-2026-20076 CVE-2026-24891
openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection
Priority HIGH 68
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus.
TI-2023-03285 CVE-2023-3520 · GHSA-fgh3-6cc5-g9mv
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit
Priority MEDIUM 54
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.
TI-2023-03014 CVE-2023-3218 · GHSA-vjvq-rcqj-pwvp
Race Condition within a Thread in it-novum/openitcockpit
Priority MEDIUM 54
Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
TI-2020-08682 CVE-2020-10789 · GHSA-mv89-3mqj-vq9h
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute…
Priority MEDIUM 46
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php.
TI-2019-11598 CVE-2019-15494 · GHSA-59x4-pqcp-87m4
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
Priority MEDIUM 45
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
TI-2019-11594 CVE-2019-15490 · GHSA-q82g-jxf6-8qm5
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
Priority MEDIUM 45
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
TI-2026-20078 CVE-2026-24893
openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion
Priority MEDIUM 43
openITCOCKPIT is an open source monitoring tool built for different monitoring engines.
TI-2020-08681 CVE-2020-10788 · GHSA-xc37-3r4w-xfwc
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key…
Priority MEDIUM 42
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.
TI-2023-18479 CVE-2023-36663 · GHSA-p7cx-46q5-8xc5
it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by…
Priority MEDIUM 41
it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface.
TI-2019-11595 CVE-2019-15491 · GHSA-8wx7-mrxw-p69g
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
Priority LOW 39
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
TI-2020-08685 CVE-2020-10792 · GHSA-36jj-833r-p2f4
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or…
Priority LOW 37
openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname containing "dev" or "staging" in the HTTP Host header.
TI-2019-11597 CVE-2019-15493 · GHSA-g3f3-78rg-6fwv
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
Priority LOW 35
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
TI-2020-08684 CVE-2020-10791 · GHSA-8q96-fjvv-8mjg
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT…
Priority LOW 31
app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to trigger outbound TCP requests (aka SSRF) via the Test Connection feature (aka test…
TI-2019-07547 CVE-2019-10227 · GHSA-8p2x-v5jj-48wf
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
Priority LOW 30
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
TI-2019-11596 CVE-2019-15492 · GHSA-87vp-mg4j-r3v3
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
Priority LOW 29
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
TI-2020-08683 CVE-2020-10790 · GHSA-q8vc-4636-99j9
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
Priority LOW 26
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.