# cockpit-hq/cockpit (Packagist) vulnerabilities 26 known vulnerabilities (4 critical, 9 high, 10 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/cockpit-hq/cockpit ## Advisories (26) ### [CVE-2026-23695](https://cve.now/CVE-2026-23695): Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template - Severity: Medium 5.1 - Published: May 15, 2026 - Affected: through 2.14.0. ### [CVE-2026-38993](https://cve.now/CVE-2026-38993): Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. - Severity: Medium 6.5 - Published: Apr 29, 2026 - Affected: fixed in 2.14.0. ### [CVE-2026-38992](https://cve.now/CVE-2026-38992): Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. - Severity: Critical 9.8 - Published: Apr 29, 2026 - Affected: fixed in 2.14.0. ### [CVE-2026-38991](https://cve.now/CVE-2026-38991): Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component \_isFileTypeAllowed function where a specially… - Severity: High 8.8 - Published: Apr 29, 2026 - Affected: fixed in 2.14.0. ### [CVE-2026-6626](https://cve.now/CVE-2026-6626): Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection - Severity: Medium 5.3 - Published: Apr 20, 2026 - Affected: fixed in 2.14.0. ### [CVE-2026-31891](https://cve.now/CVE-2026-31891): Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() - Severity: High 7.7 - Published: Mar 18, 2026 - Affected: fixed in 2.13.5. ### [CVE-2025-7053](https://cve.now/CVE-2025-7053): Cockpit save cross site scripting - Severity: Medium 5.1 - Published: Jul 4, 2025 - Affected: fixed in 2.11.4. ### [CVE-2025-1025](https://cve.now/CVE-2025-1025): Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different… - Severity: High 8.7 - Published: Feb 5, 2025 - Affected: fixed in 2.4.1. ### [CVE-2024-4825](https://cve.now/CVE-2024-4825): Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo - Severity: Critical 9.8 - Published: May 13, 2024 - Affected: fixed in 2.7.0. ### [CVE-2024-2001](https://cve.now/CVE-2024-2001): Cross-Site Scripting vulnerability in Cockpit CMS - Severity: Medium 5.5 - Published: Feb 29, 2024 - Affected: versions 2.7.0. ### [CVE-2023-41564](https://cve.now/CVE-2023-41564): An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via… - Severity: Unrated - Published: Sep 8, 2023 - Affected: through 2.6.3. ### [CVE-2023-4451](https://cve.now/CVE-2023-4451): Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit - Severity: Medium 6.1 - Published: Aug 20, 2023 - Affected: through 2.6.3. ### [CVE-2023-4433](https://cve.now/CVE-2023-4433): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit - Severity: High 8.3 - Published: Aug 19, 2023 - Affected: through 2.6.3. ### [CVE-2023-4432](https://cve.now/CVE-2023-4432): Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit - Severity: High 8.3 - Published: Aug 19, 2023 - Affected: through 2.6.3. ### [CVE-2023-4422](https://cve.now/CVE-2023-4422): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit - Severity: Medium 6.8 - Published: Aug 18, 2023 - Affected: fixed in 2.6.3. ### [CVE-2023-4395](https://cve.now/CVE-2023-4395): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit - Severity: High 8.1 - Published: Aug 17, 2023 - Affected: through 2.6.3. ### [CVE-2023-4321](https://cve.now/CVE-2023-4321): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit - Severity: High 8.3 - Published: Aug 14, 2023 - Affected: through 2.6.2. ### [CVE-2023-4196](https://cve.now/CVE-2023-4196): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit - Severity: High 8.3 - Published: Aug 6, 2023 - Affected: fixed in 2.6.3. ### [CVE-2023-4195](https://cve.now/CVE-2023-4195): PHP Remote File Inclusion in cockpit-hq/cockpit - Severity: Critical 9.9 - Published: Aug 6, 2023 - Affected: fixed in 2.6.3. ### [CVE-2023-37650](https://cve.now/CVE-2023-37650): A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. - Severity: Unrated - Published: Jul 20, 2023 - Affected: fixed in 2.6.0. ### [CVE-2023-37649](https://cve.now/CVE-2023-37649): Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. - Severity: Unrated - Published: Jul 20, 2023 - Affected: fixed in 2.6.0. ### [CVE-2023-1313](https://cve.now/CVE-2023-1313): Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit - Severity: High 7.2 - Published: Mar 10, 2023 - Affected: fixed in 2.4.1. ### [CVE-2023-1160](https://cve.now/CVE-2023-1160): Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit - Severity: Medium 4.0 - Published: Mar 3, 2023 - Affected: through 2.3.9. ### [CVE-2023-0780](https://cve.now/CVE-2023-0780): Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit - Severity: Medium 4.0 - Published: Feb 11, 2023 - Affected: fixed in 2.3.9. ### [CVE-2023-0759](https://cve.now/CVE-2023-0759): Privilege Chaining in cockpit-hq/cockpit - Severity: Medium 5.3 - Published: Feb 9, 2023 - Affected: fixed in 2.3.8. ### [CVE-2022-2818](https://cve.now/CVE-2022-2818): Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit - Severity: Critical 9.8 - Published: Aug 15, 2022 - Affected: fixed in 2.2.2. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/cockpit-hq/cockpit Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.