[MEDIUM] Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option

PKSA-by8z-q792-wbvd CVE-2026-23695 GHSA-ch4j-vcf5-58x5

Affected version: <=2.14.0

Reported by:
GitHub

[MEDIUM] Cockpit is vulnerable to directory traversal

PKSA-gx1h-274c-423s CVE-2026-38993 GHSA-p46p-7pmj-m34f

Affected version: <2.14.0

Reported by:
GitHub

[HIGH] Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type

PKSA-dpw9-65w1-pksf CVE-2026-38991 GHSA-j2rx-4jg9-79mw

Affected version: <2.14.0

Reported by:
GitHub

[CRITICAL] Cockpit is vulnerable to arbitrary code execution

PKSA-496r-cnzn-ck12 CVE-2026-38992 GHSA-fm6c-rhcf-7439

Affected version: <2.14.0

Reported by:
GitHub

[LOW] Cockpit has NoSQL Injection Through Content Aggregation Pipelines

PKSA-qffw-6vr2-p3h9 CVE-2026-6626 GHSA-5pv2-86qj-5jf9

Affected version: <2.14.0

Reported by:
GitHub

[HIGH] Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

PKSA-rm9w-whnt-2jgw CVE-2026-31891 GHSA-7x5c-vfhj-9628

Affected version: <2.13.5

Reported by:
GitHub

[MEDIUM] Cockpit - Content Platform vulnerable to XSS through name or email argument names

PKSA-htm2-8b2r-zt3z CVE-2025-7053 GHSA-j4rj-fgcq-wmqp

Affected version: <2.11.4

Reported by:
GitHub

[HIGH] Cockpit Arbitrary File Upload

PKSA-7dr9-jcxs-g5km CVE-2025-1025 GHSA-wp68-xrfg-xvq4

Affected version: <2.4.1

Reported by:
GitHub

[CRITICAL] Cockpit CMS contains an arbitrary file upload vulenrability

PKSA-1g11-thhn-qmqq CVE-2024-4825 GHSA-vpj8-xfqc-jcv9

Affected version: <2.7.0

Reported by:
GitHub

[MEDIUM] Cockpit CMS Cross-Site Scripting vulnerability

PKSA-z9px-xfdf-k8xr CVE-2024-2001 GHSA-q76r-7p4q-mqpw

Affected version: =2.7.0

Reported by:
GitHub

[MEDIUM] Cockpit CMS arbitrary file upload vulnerability

PKSA-dkf9-ctj9-6715 CVE-2023-41564 GHSA-38vf-35cg-m73w

Affected version: <=2.6.3

Reported by:
GitHub

[MEDIUM] Cockpit Cross-site Scripting vulnerability

PKSA-t4f4-3p1b-pwvn CVE-2023-4451 GHSA-g3mv-64h3-h482

Affected version: <=2.6.3

Reported by:
GitHub

[HIGH] Cockpit Cross-site Scripting vulnerability

PKSA-xrwz-4p22-v3sh CVE-2023-4432 GHSA-rmgx-3w4r-xcfp

Affected version: <=2.6.3

Reported by:
GitHub

[HIGH] Cockpit Cross-site Scripting vulnerability

PKSA-j62f-f87n-nv4p CVE-2023-4433 GHSA-ff45-2jp9-69jc

Affected version: <=2.6.3

Reported by:
GitHub

[MEDIUM] Cockpit Cross-site Scripting vulnerability

PKSA-vwbc-y3t3-84k8 CVE-2023-4422 GHSA-8m65-qq6g-43rr

Affected version: <2.6.3

Reported by:
GitHub

[HIGH] Cockpit Cross-site Scripting vulnerability

PKSA-55bx-95g3-bdpb CVE-2023-4395 GHSA-5cv4-48h7-7782

Affected version: <=2.6.3

Reported by:
GitHub

[HIGH] Cockpit Cross-site Scripting vulnerability

PKSA-znb8-w45f-64b5 CVE-2023-4321 GHSA-3vf5-xm2p-6mh5

Affected version: <=2.6.2

Reported by:
GitHub

[HIGH] Cockpit Cross-site Scripting vulnerability

PKSA-ys3f-9xrr-xrsz CVE-2023-4196 GHSA-w3qm-93vf-5hrw

Affected version: <2.6.3

Reported by:
GitHub

[CRITICAL] Cockpit PHP Remote File Inclusion vulnerability

PKSA-ywbw-pgpj-12g6 CVE-2023-4195 GHSA-xcq3-7pf3-5jvc

Affected version: <2.6.3

Reported by:
GitHub

[HIGH] Cockpit CMS Cross-Site Request Forgery vulnerability

PKSA-6cf3-m793-4f7h CVE-2023-37650 GHSA-45g2-r339-pjwf

Affected version: <2.6.0

Reported by:
GitHub

[HIGH] Cockpit CMS vulnerable to incorrect access control

PKSA-61gq-gryd-k7qp CVE-2023-37649 GHSA-9r25-4j77-9wc7

Affected version: <2.6.0

Reported by:
GitHub

[HIGH] cockpit-hq/cockpit is vulnerable to unrestricted file uploads

PKSA-dyd6-q5kw-cnzs CVE-2023-1313 GHSA-6x8f-x6qw-qwx3

Affected version: <2.4.1

Reported by:
GitHub

[MEDIUM] Cockpit Uses Platform-Dependent Third Party Components

PKSA-xv8s-t5k3-3fys CVE-2023-1160 GHSA-p8cq-pv6w-6rwx

Affected version: <=2.3.9

Reported by:
GitHub

[MEDIUM] Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit

PKSA-ch6m-qfpx-wtvr CVE-2023-0780 GHSA-gm7m-rqf8-jx4m

Affected version: <2.3.9

Reported by:
GitHub

[HIGH] privilege chaining in cockpit-hq/cockpit

PKSA-99sv-2wdf-h212 CVE-2023-0759 GHSA-86rf-38v8-9c4x

Affected version: <2.3.8

Reported by:
GitHub

[HIGH] Cockpit Content Platform vulnerable to 2FA bypass

PKSA-1bzm-v7vr-v5fm CVE-2022-2818 GHSA-8wj3-cpmr-8whp

Affected version: <=2.2.1

Reported by:
GitHub