Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

41 records

Vendor: cockpit-hq Clear all filters
TI-2026-71282 CVE-2026-109379 · GHSA-gm9c-qwh2-h88c

Timing discrepancy in Cockpit CMS login check enables account enumeration

Priority LOW 36

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00348 Published 2026-10-12 No fix listed CWE-208
TI-2026-67555 CVE-2026-105217 · GHSA-7gf3-cfh5-c772

Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Priority LOW 11

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00103 Published 2026-10-04 Partial fix · 2.14.1 CWE-295
TI-2026-56846 CVE-2026-82449 · GHSA-x5j5-9mrv-74fr

Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Priority LOW 37

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00419 Published 2026-08-29 Fixed in 2.14.1 CWE-208
TI-2026-51759 CVE-2026-73680 · GHSA-4x4q-mx3g-g3m2

Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Priority MEDIUM 45

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02801 Published 2026-08-14 No fix listed CWE-78
TI-2026-42071 CVE-2026-58467 · GHSA-f6g9-3r3j-32rg

Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php

Priority HIGH 75

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived fr…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0173 Published 2026-07-02 No fix listed CWE-22
TI-2026-19079 CVE-2026-23695 · GHSA-ch4j-vcf5-58x5

Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template

Priority LOW 22

Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpol…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00138 Published 2026-05-15 Fixed CWE-79
TI-2025-06416 CVE-2025-7053 · GHSA-j4rj-fgcq-wmqp

Cockpit save cross site scripting

Priority MEDIUM 56

A vulnerability was found in Cockpit up to 2.11.3.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00363 Published 2025-07-04 Fixed in 2.11.4 CWE-79
TI-2024-01861 CVE-2024-2001 · GHSA-q76r-7p4q-mqpw

Cross-Site Scripting vulnerability in Cockpit CMS

Priority LOW 25

A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00323 Published 2024-02-29 No fix listed CWE-79
TI-2023-03884 CVE-2023-4195 · GHSA-xcq3-7pf3-5jvc

PHP Remote File Inclusion in cockpit-hq/cockpit

Priority HIGH 71

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01053 Published 2023-08-06 Fixed in 2.6.3 CWE-98
Load more