CVE-2026-39275

Cockpit CMS versions 2.13.5 and below are affected by a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the item.php , field-select.js , and tags.js components. The flaw allows a remote attacker with low privileges to achieve account takeover with high confidentiality and integrity im...

EUVD-2026-66750

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...