71 matches found
CVE-2026-38991
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code...
GHSA-5PV2-86QJ-5JF9 Cockpit has NoSQL Injection Through Content Aggregation Pipelines
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack...
EUVD-2026-23822
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack...
Exploit for CVE-2026-4631
CVE-2026-4631 — Code Analysis Cockpit: Unauthenticated Rem...
Oracle Linux 9 : cockpit: / Unauthenticated / remote / code / execution / due / to / SSH / command-line / argument / injection / (CRITICAL) (ELSA-2026-7384)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-7384 advisory. 344-2.0.1 - Storage: Enable btrfs support Orabug: 37464632 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop...
AlmaLinux 9 : cockpitUnauthenticated remote code execution due to SSH command-line argument injection (Critical) (ALSA-2026:7384)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:7384 advisory. cockpit: ws: be more explicit when handling hostnames on cli CVE-2026-4631 Tenable has extracted the preceding description block directly from the AlmaLinux securi...
AlmaLinux 10 : cockpitUnauthenticated remote code execution due to SSH command-line argument injection (Critical) (ALSA-2026:7383)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:7383 advisory. cockpit: ws: be more explicit when handling hostnames on cli CVE-2026-4631 Tenable has extracted the preceding description block directly from the AlmaLinux...
EUVD-2026-22173
Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer...
PT-2026-32569
CVE-2026-34262 - SAP HANA Cockpit leaks X.509 private keys via Database Explorer access patching isn't enough here. the keys are already out. if you're affected, you need to manually revoke and rotate certificates or the door stays open for server impersonation. that's the part most teams will...
Oracle Linux 10 : cockpit: / Unauthenticated / remote / code / execution / due / to / SSH / command-line / argument / injection / (CRITICAL) (ELSA-2026-7383)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-7383 advisory. - correctly apply CVE patches CVE-2026-4631 Wed Mar 25 2026 Jelle van der Waa [email protected] - 344-3 Tenable has extracted the preceding description block...
cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...
SUSE: Security Advisory (SUSE-SU-2026:20337-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MiracleLinux 9 : cockpit-311.2-1.el9_4.ML.1 (AXSA:2024-8451:13)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8451:13 advisory. cockpit: command injection when deleting a sosreport with a crafted name CVE-2024-2947 CVE-2024-2947 A flaw was found in Cockpit. Deleting a sosreport with a...
MiracleLinux 8 : cockpit-310.4-1.el8_10.ML.1 (AXSA:2024-8473:14)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8473:14 advisory. cockpit: command injection when deleting a sosreport with a crafted name CVE-2024-2947 Tenable has extracted the preceding description block directly from th...
ROS-20251226-7301
Vulnerability in cockpit due to insufficient validation of incoming requests. Exploitation of the vulnerability could allow an attacker acting remotely to launch an ssrf attack...
EUVD-2018-3502
Malware in sbrugna...
EUVD-2020-27998
Malware in sbrugna...
EUVD-2021-26955
Malware in sbrugna...