cockpit
- Software type
- Content management system
- Total vulnerabilities (90 days)
- 3
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/17/2026, cockpit recorded 3 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of cockpit and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109379Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/checkCVE-2026-105217Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.phpCVE-2026-82449Cockpit CMS before 2.14.1 Account Enumeration via Auth TimingCVE-2026-58467Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.phpCVE-2026-23695Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-109379Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-105217Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php | Exploitation statusNot exploited | FixYes | Published10/04/2026 | SeverityLow |
|---|
CVE-2026-82449Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing | Exploitation statusNot exploited | FixYes | Published08/29/2026 | SeverityMedium |
|---|
CVE-2026-58467Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php | Exploitation statusActively exploited | FixNo | Published07/02/2026 | SeverityHigh |
|---|
CVE-2026-23695Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template | Exploitation statusNot exploited | FixYes | Published05/15/2026 | SeverityMedium |
|---|
CVE-2026-6626Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection | Exploitation statusActively exploited | FixNo | Published04/20/2026 | SeverityMedium |
|---|
CVE-2026-31891Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() | Exploitation statusNot exploited | FixYes | Published03/18/2026 | SeverityHigh |
|---|
CVE-2023-4451Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit | Exploitation statusActively exploited | FixYes | Published08/20/2023 | SeverityMedium |
|---|
CVE-2023-4433Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit | Exploitation statusActively exploited | FixYes | Published08/19/2023 | SeverityHigh |
|---|
CVE-2023-4432Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit | Exploitation statusActively exploited | FixYes | Published08/19/2023 | SeverityHigh |
|---|
15 Results | Page 1 of 2