Skip to content
OpenAdvisories

Vendor

cockpit-hq

24 known vulnerabilities.

Products

cockpit-hq/cockpit 14 cockpit 7 Cockpit CMS 3
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-109379

    Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

    Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing…

    cockpit-hq cockpit
  • Medium 5.3
    CVE-2026-82449

    Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

    Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observi…

    cockpit-hq cockpit
  • Medium 5.4
    CVE-2026-23695

    Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template

    Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's Display template option, where the template string is processed by the $interpolate function using new Function() and r…

    cockpit-hq cockpit cockpit-hq/cockpit Packagist
  • Medium 6.3
    CVE-2026-6626

    Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection

    A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic…

    cockpit-hq cockpit cockpit-hq/cockpit Packagist
  • Medium 6.1
    CVE-2023-4451 Scanner template

    Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit

    Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • Medium 6.8
    CVE-2023-4422

    Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • Medium 4.0
    CVE-2023-1160

    Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit

    Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • Medium 4.0
    CVE-2023-0780

    Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • Medium 5.3
    CVE-2023-0759

    Privilege Chaining in cockpit-hq/cockpit

    Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist