1992 matches found
RHEL 10 : cockpit-machines (RHSA-2026:86971)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86971 advisory. Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via...
ALSA-2026:86971 Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...
RockyLinux 10 : cockpit-machines (RLSA-2026:86971)
The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:86971 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Dat...
Oracle Linux 10 : cockpit-machines (ELSA-2026-86971)
The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-86971 advisory. - CVE-2026-92768 RHEL-263124 - CVE-2026-92747 RHEL-263120 Tenable has extracted the preceding description block directly from the Oracle Linux securi...
Oracle Linux 9 : cockpit-files (ELSA-2026-84595)
The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-84595 advisory. - CVE-2026-91202 - Don't de-reference a symlink when creating a directory RHEL-263134 Tenable has extracted the preceding description block directly...
Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...
CVE-2020-35847_CVE-2020-35848
Cockpit CMS NoSQL Injection CVE-2020-35847, CVE-2020-35848 Cockpit CMS before version 0.11.2 is vulnerable to a NoSQL Injection vulnerability in the /auth/resetpassword and /auth/newpassword that allows extraction of password reset tokens which allow for user details enumeration as well as passwo...
CVE-2026-4631-cockpit-RCE
CVE-2026-4631 — Code Analysis Cockpit: Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Field| Detail ---|--- CVE ID| CVE-2026-4631 GHSA| GHSA-m4gv-x78h-3427 Severity| Critical CVSS 9.8 Affected versions| Cockpit 327 – 359 Fixed in| Cockpit 360 CWE| CWE-78: OS Command...
DEBIAN-CVE-2026-113496
A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...
DEBIAN-CVE-2026-113495
A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...
CVE-2026-113496
A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...
CVE-2026-113495
A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...
RLSA-2026:84595 Moderate: cockpit-files security update
A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...
cockpit-files security update
An update is available for cockpit-files. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A filesystem browser for Cockpit Security Fixes: cockpit-files:...
EUVD-2026-104960
A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...
CVE-2026-113496
A vulnerability exists in cockpit-machines where VNC console passwords are disclosed via command-line arguments. When saving settings, the software passes the password directly to an underlying system utility. A local unprivileged attacker capable of cross-user process inspection can read this pa...
CVE-2026-113496 Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...
CVE-2026-113496 Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...
EUVD-2026-104959
A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...
CVE-2026-113495 Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...