cockpit
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-7053 | 2.11.0 ; 2.11.1 ; 2.11.2 ; … | Cockpit save cross site scripting | MEDIUM 5.1 | 0.4 % | ||
| CVE-2024-6126 | | Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option | LOW 3.2 | 0.3 % | ||
| CVE-2024-2947 | ≥ 270 | Cockpit: command injection when deleting a sosreport with a crafted name | HIGH 7.3 | 1.2 % | ||
| CVE-2021-3698 | cockpit versions prior to 260 | A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Ser | HIGH 7.5 | 0.7 % | ||
| CVE-2021-3660 | Fixed in cockpit v254 and later. | Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via anot | MEDIUM 4.3 | 1.3 % |