CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cockpit CMS versions 2.13.5 and before are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) leading to Account Takeover . The root cause is the lack of output encoding when passing render() outputs to the Vue.js v-html directive within the item.php , field-select.js , and ...

EUVD-2026-66750

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

SUSE CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

UBUNTU-CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235

The login page handler in cockpit-ws (the Cockpit web service) leaks a heap allocation on every unauthenticated request carrying a CockpitLang cookie, in the send_login_html function. An unauthenticated remote attacker can repeatedly trigger this to exhaust host memory and cause denial of service...

CVE-2026-76235 Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

EUVD-2026-62393

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235 Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Mitigation Restrict network access...

Linux Distros Unpatched Vulnerability : CVE-2026-76235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie,...

PT-2026-78350

Name of the Vulnerable Software and Affected Versions cockpit-ws affected versions not specified Description A memory leak exists in the login page handler. A remote unauthenticated attacker can cause a denial of service by exhausting host memory through repeated unauthenticated requests containi...

CVE-2026-76235: Missing Release of Memory after Effective Lifetime

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service...

RHBA-2026:21387 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update

Bulletin has no description...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...