Ramas de versiones afectadas
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2026-109379 | Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check | ≥ 2.14.1 ≤ 2.14.1 | 6.9 | — | 2026-10-13 | |
| CVE-2026-105217 | Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php | ≥ 2.12.0 < 2.14.1 | 2.3 | — | 2026-10-05 | |
| CVE-2026-82449 | Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing | < 2.14.1 | 6.9 | — | 2026-08-29 | |
| CVE-2026-39275 | Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbi... | * | 6.1 | — | 2026-08-26 | |
| CVE-2026-73680 | Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename | * | 8.7 | — | 2026-08-15 | |
| CVE-2026-72557 | Cockpit CMS Cockpit CMS - Unrestricted File Upload | * | 8.8 | — | 2026-08-11 | |
| CVE-2026-57856 | Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API | * | 8.7 | — | 2026-07-14 | |
| CVE-2026-57855 | Cockpit CMS Missing Authorization in Bucket File Storage API | * | 8.7 | — | 2026-07-14 | |
| CVE-2026-58467 | Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php | ≤ 2.14.0 | 8.2 | — | 2026-07-03 | |
| CVE-2026-23695 | Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template | ≤ 2.14.0 | 5.1 | — | 2026-05-16 | |
| CVE-2026-38992 | Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple... | * | 9.8 | — | 2026-04-29 | |
| CVE-2026-38991 | Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed fu... | * | 8.8 | — | 2026-04-29 | |
| CVE-2026-38993 | Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability... | * | 6.5 | — | 2026-04-29 | |
| CVE-2026-6626 | Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection | = 2.13.0 = 2.13.1 = 2.13.2 | 5.3 | — | 2026-04-20 | |
| CVE-2026-31891 | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() | * | 7.7 | — | 2026-03-18 | |
| CVE-2025-1025 | Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attac... | * | 8.7 | — | 2025-02-05 | |
| CVE-2023-4451 | Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit | * | 6.1 | — | 2023-08-20 | |
| CVE-2023-4433 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit | * | 8.3 | — | 2023-08-19 | |
| CVE-2023-4432 | Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit | * | 8.3 | — | 2023-08-19 | |
| CVE-2023-4422 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit | * | 6.8 | — | 2023-08-19 | |
| CVE-2023-4395 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit | * | 8.1 | — | 2023-08-17 | |
| CVE-2023-4321 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit | * | 8.3 | — | 2023-08-14 | |
| CVE-2023-4196 | Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit | * | 8.3 | — | 2023-08-07 | |
| CVE-2023-4195 | PHP Remote File Inclusion in cockpit-hq/cockpit | * | 9.9 | — | 2023-08-07 | |
| CVE-2023-37650 | A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbi... | * | — | — | 2023-07-20 | |
| CVE-2023-37649 | Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers... | * | — | — | 2023-07-20 | |
| CVE-2023-1313 | Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit | * | 7.2 | — | 2023-03-10 | |
| CVE-2023-1160 | Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit | * | 4.0 | — | 2023-03-03 | |
| CVE-2023-0780 | Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit | * | 4.0 | — | 2023-02-11 | |
| CVE-2023-0759 | Privilege Chaining in cockpit-hq/cockpit | * | 5.3 | — | 2023-02-09 | |
| CVE-2022-2818 | Improper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit | * | 9.8 | — | 2022-08-15 | |
| CVE-2022-2713 | Insufficient Session Expiration in cockpit-hq/cockpit | * | 8.6 | — | 2022-08-08 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).