CVE Tools
Track your stack

Cockpit

49 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Cockpit, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Cockpit CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Cockpit CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-021
2025-030
2025-040
2025-050
2025-060
2025-071
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-031
2026-042
2026-051
2026-060
2026-071
2026-081
2026-090
2026-102

Severity

How the 49 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1224%
  • High1327%
  • Medium2143%
  • Low36%

Latest CVEs

The 15 most recently published vulnerabilities affecting Cockpit.

  1. CVE-2026-109379Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check5.3
  2. CVE-2026-105217Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php3.1
  3. CVE-2026-82449Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing5.3
  4. CVE-2026-58467Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php7.5
  5. CVE-2026-23695Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template5.4
  6. CVE-2026-6626Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection6.3
  7. CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection9.8
  8. CVE-2026-31891Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()7.7
  9. CVE-2025-7053Cockpit save cross site scripting3.5
  10. CVE-2025-1025Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.7.5
  11. CVE-2024-6656Hardcoded Credentals in TNB Mobile Solutions' Cockpit Software9.8
  12. CVE-2024-6126Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option3.2
  13. CVE-2024-1272Information Disclosure to Source Code in TNB Mobile Solutions' Cockpit Software7.5
  14. CVE-2024-4825Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo9.8
  15. CVE-2024-2947Cockpit: command injection when deleting a sosreport with a crafted name7.3

Product grouping is registry-driven, with AI assist and human review. How it works