cockpit-hq

12 results · Clear filters · Feed

• High 8.8
  CVE-2026-73680

  Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

  Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden f…

  cockpit-hq Cockpit CMS
  Aug 14, 2026
• High 8.8
  CVE-2026-57856

  Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

  Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '…

  cockpit-hq Cockpit CMS
  Jul 13, 2026
• High 8.8
  CVE-2026-57855

  Cockpit CMS Missing Authorization in Bucket File Storage API

  Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without perform…

  cockpit-hq Cockpit CMS
  Jul 13, 2026
• High 7.5
  CVE-2026-58467 Scanner template

  Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php

  Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path const…

  cockpit-hq cockpit
  Jul 2, 2026
• High 7.7
  CVE-2026-31891 Public exploit

  Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

  Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/a…

  cockpit-hq cockpit cockpit-hq/cockpit cockpit Ubuntu Packagist
  Mar 18, 2026
• High 8.3
  CVE-2023-4433

  Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

  Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Aug 19, 2023
• High 8.3
  CVE-2023-4432

  Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit

  Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Aug 19, 2023
• High 8.1
  CVE-2023-4395

  Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

  Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Aug 17, 2023
• High 8.3
  CVE-2023-4321

  Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

  Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Aug 14, 2023
• High 8.3
  CVE-2023-4196

  Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

  Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Aug 6, 2023
• High 7.2
  CVE-2023-1313

  Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit

  Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.

  cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  Mar 10, 2023
• High 8.6
  CVE-2022-2713

  Insufficient Session Expiration in cockpit-hq/cockpit

  Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.

  cockpit-hq cockpit-hq/cockpit aheinze/cockpit Packagist
  Aug 8, 2022