- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 26 · 4 critical, 9 high, 10 medium
- Registry
- Packagist
Advisories 26
- CVE-2026-23695Medium 5.1
Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template
Affected: through 2.14.0.
- CVE-2026-38993Medium 6.5
Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component.
Affected: fixed in 2.14.0.
- CVE-2026-38992Critical 9.8
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints.
Affected: fixed in 2.14.0.
- CVE-2026-38991High 8.8
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially…
Affected: fixed in 2.14.0.
- CVE-2026-6626Medium 5.3
Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection
Affected: fixed in 2.14.0.
- CVE-2026-31891High 7.7
Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
Affected: fixed in 2.13.5.
- CVE-2025-7053Medium 5.1
Cockpit save cross site scripting
Affected: fixed in 2.11.4.
- CVE-2025-1025High 8.7
Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different…
Affected: fixed in 2.4.1.
- CVE-2024-4825Critical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo
Affected: fixed in 2.7.0.
- CVE-2024-2001Medium 5.5
Cross-Site Scripting vulnerability in Cockpit CMS
Affected: versions 2.7.0.
- CVE-2023-41564Unrated
An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via…
Affected: through 2.6.3.
- CVE-2023-4451Medium 6.1
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
Affected: through 2.6.3.
- CVE-2023-4433High 8.3
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Affected: through 2.6.3.
- CVE-2023-4432High 8.3
Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit
Affected: through 2.6.3.
- CVE-2023-4422Medium 6.8
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Affected: fixed in 2.6.3.
Show all 26 advisoriesShow fewer advisories
- CVE-2023-4395High 8.1
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Affected: through 2.6.3.
- CVE-2023-4321High 8.3
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Affected: through 2.6.2.
- CVE-2023-4196High 8.3
Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit
Affected: fixed in 2.6.3.
- CVE-2023-4195Critical 9.9
PHP Remote File Inclusion in cockpit-hq/cockpit
Affected: fixed in 2.6.3.
- CVE-2023-37650Unrated
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
Affected: fixed in 2.6.0.
- CVE-2023-37649Unrated
Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.
Affected: fixed in 2.6.0.
- CVE-2023-1313High 7.2
Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit
Affected: fixed in 2.4.1.
- CVE-2023-1160Medium 4.0
Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit
Affected: through 2.3.9.
- CVE-2023-0780Medium 4.0
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit
Affected: fixed in 2.3.9.
- CVE-2023-0759Medium 5.3
Privilege Chaining in cockpit-hq/cockpit
Affected: fixed in 2.3.8.
- CVE-2022-2818Critical 9.8
Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit
Affected: fixed in 2.2.2.