CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 14/05/2024 |
| CVE-2024-2001 | MEDIO5.4 | A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded. | 29/02/2024 |
| CVE-2023-41564 | MEDIO6.1 | An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file. | 08/09/2023 |
| CVE-2023-4451 | MEDIO6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 20/08/2023 |
| CVE-2023-4433 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 19/08/2023 |
| CVE-2023-4432 | MEDIO6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 19/08/2023 |
| CVE-2023-4422 | MEDIO4.8 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | 18/08/2023 |
| CVE-2023-4395 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4. | 17/08/2023 |
| CVE-2023-4321 | MEDIO6.1 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3. | 14/08/2023 |
| CVE-2023-4196 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | 06/08/2023 |
| CVE-2023-4195 | ALTO8.8 | PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. | 06/08/2023 |
| CVE-2023-37650 | ALTO8.8 | A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. | 20/07/2023 |
| CVE-2023-37649 | ALTO7.5 | Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. | 20/07/2023 |
| CVE-2023-1313 | ALTO8.8 | Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. | 10/03/2023 |
| CVE-2023-1160 | MEDIO5.5 | Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit prior to 2.4.0. | 03/03/2023 |
| CVE-2021-32857 | MEDIO6.1 | Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue. | 21/02/2023 |
| CVE-2023-0780 | MEDIO5.4 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev. | 11/02/2023 |
| CVE-2023-0759 | ALTO8.8 | Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. | 09/02/2023 |