What’s Vulnerable › Products

cockpit-hq/cockpit vulnerabilities

39 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your cockpit-hq/cockpit version is affected

Latest cockpit-hq/cockpit vulnerabilities

• CVE-2026-109379 — Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check (CVSS 5.3)
• CVE-2026-105217 — Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php (CVSS 3.1)
• CVE-2026-82449 — Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing (CVSS 5.3)
• CVE-2026-72557 — Cockpit CMS Cockpit CMS - Unrestricted File Upload (CVSS 8.8)
• CVE-2026-58467 — Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php (CVSS 7.5)
• CVE-2026-13533 — agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access (CVSS 5.3)
• CVE-2026-23695 — Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template (CVSS 5.4)
• CVE-2026-6626 — Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection (CVSS 6.3)
• CVE-2026-31891 — Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() (CVSS 6.5)
• CVE-2025-7053 — Cockpit save cross site scripting (CVSS 6.1)
• CVE-2024-4825 — Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo (CVSS 9.8)
• CVE-2024-2001 — Cross-Site Scripting vulnerability in Cockpit CMS (CVSS 5.4)
• CVE-2023-41564 — (CVSS 6.1)
• CVE-2023-4451 — Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit (CVSS 6.1)
• CVE-2023-4433 — Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 5.4)
• CVE-2023-4432 — Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit (CVSS 6.1)
• CVE-2023-4422 — Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 4.8)
• CVE-2023-4395 — Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 5.4)
• CVE-2023-4321 — Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 6.1)
• CVE-2023-4196 — Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 5.4)
• CVE-2023-4195 — PHP Remote File Inclusion in cockpit-hq/cockpit (CVSS 8.8)
• CVE-2023-37650 — (CVSS 8.8)
• CVE-2023-37649 — (CVSS 7.5)
• CVE-2023-1313 — Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit (CVSS 8.8)
• CVE-2023-1160 — Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit (CVSS 5.5)