CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Mitigation Restrict network access...

Linux Distros Unpatched Vulnerability : CVE-2026-76235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie,...

RHBA-2026:21387 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update

Bulletin has no description...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

EUVD-2026-58799

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and earlier exposes a command-injection vulnerability in the FFmpeg integration. An authenticated user with assets/upload can upload a video file whose filename contains shell metacharacters; the unsanitized filename is interpolated into a shell command executed via Process::fr...

PT-2026-72118

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.14.1 Description An issue in the FFmpeg integration allows authenticated users with assets/upload permissions to execute arbitrary commands. This occurs when a video file is uploaded with a filename containing...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72557 Cockpit CMS Cockpit CMS - Unrestricted File Upload

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72557

Cockpit CMS 2.6.0 is affected by an unrestricted file upload in the asset upload endpoint. The issue arises from allowed_uploads defaulting to a wildcard (*) and storing uploads in a web-accessible directory, enabling any authenticated user to upload files with arbitrary extensions (including PHP...

CVE-2026-72557

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

EUVD-2026-56027

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

CVE-2026-72557 Cockpit CMS Cockpit CMS - Unrestricted File Upload

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

OPENSUSE-SU-2026:11446-1 cockpit-repos-4.9-1.1 on GA media

These are all security issues fixed in the cockpit-repos-4.9-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11447-1 cockpit-subscriptions-16.3-1.1 on GA media

These are all security issues fixed in the cockpit-subscriptions-16.3-1.1 package on the GA media of openSUSE Tumbleweed...

VulnCheck KEV: CVE-2026-38992

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator...

openSUSE 16: cockpit / cockpit-bridge / cockpit-devel / cockpit-firewalld / etc (openSUSE-SU-2026:21399-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21399-1 advisory. Security issues fixed: - CVE-2025-13465: lodash: prototype pollution in the .unset and .omit functions can lead to deletion of methods from glob...