CO
Vendor
cockpit-hq
11
CVEs
0
On KEV
2
New 30D
Products
CO7.5
cockpit
cockpit-hq
7 CVEs0 on KEV2 new
CC8.8
Cockpit CMS
Cockpit HQ
3 CVEs0 on KEV0 new
CO9.8
cockpit-hq/cockpit
cockpit-hq
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109379 | CO cockpit cockpit-hq | 5.3 | Oct 12 | Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check |
| CVE-2026-105217 | CO cockpit cockpit-hq | 3.1 | Oct 4 | Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php |
| CVE-2026-82449 | CO cockpit cockpit-hq | 5.3 | Aug 29 | Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing |
| CVE-2026-73680 | CC Cockpit CMS Cockpit HQ | 8.8 | Aug 14 | Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename |
| CVE-2026-57856 | CC Cockpit CMS Cockpit HQ | 8.8 | Jul 13 | Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API |
| CVE-2026-57855 | CC Cockpit CMS Cockpit HQ | 8.8 | Jul 13 | Cockpit CMS Missing Authorization in Bucket File Storage API |
| CVE-2026-58467 | CO cockpit cockpit-hq | 7.5 | Jul 2 | Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php |
| CVE-2026-23695 | CO Cockpit Cockpit-HQ | 5.4 | May 15 | Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template |
| CVE-2026-6626 | CO Cockpit Cockpit-HQ | 6.3 | Apr 20 | Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection |
| CVE-2026-31891 | CO Cockpit Cockpit-HQ | 6.5 | Mar 18 | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() |
| CVE-2022-2713 | CO cockpit-hq/cockpit cockpit-hq | 9.8 | Aug 8 | Insufficient Session Expiration in cockpit-hq/cockpit |