# cobbler (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/cobbler Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cobbler.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in cobbler (PyPI): 0 in the last 7 days and 0 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2010-2235, was published on 6 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 18 (4 critical, 0 exploited in the wild) ## About cobbler (PyPI) Systems provisioning and configuration management tool for Linux environments. ## Latest cobbler (PyPI) vulnerabilities - [CVE-2010-2235: PYSEC-2026-794 - Cobbler is vulnerable to code injection](https://junglewise.ai/threats/cve-2010-2235-cobbler-is-vulnerable-to-code-injection) (info, published 6 Jul 2026) - [CVE-2012-2395: PYSEC-2026-792 - Cobbler subject to Command Injection](https://junglewise.ai/threats/cve-2012-2395-cobbler-subject-to-command-injection) (info, published 6 Jul 2026) - [CVE-2011-4953: PYSEC-2026-793 - Cobbler vulnerable to code injection via unsafe YAML loading](https://junglewise.ai/threats/cve-2011-4953-cobbler-vulnerable-to-code-injection-via-unsafe-yaml-loading) (info, published 6 Jul 2026) - [CVE-2008-6954: PYSEC-2026-795 - Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2008-6954-cobbler-web-interface-kickstart-template-remote-privilege) (info, published 6 Jul 2026) - [CVE-2014-3225: PYSEC-2026-797 - Cobbler Path Traversal vulnerability](https://junglewise.ai/threats/cve-2014-3225-cobbler-path-traversal-vulnerability) (info, published 6 Jul 2026) - [CVE-2018-1000225: PYSEC-2026-796 - Cobbler XSS Vulnerability](https://junglewise.ai/threats/cve-2018-1000225-cobbler-xss-vulnerability) (low, CVSS 3, published 6 Jul 2026) - [CVE-2016-9605: PYSEC-2026-623 - Cobbler Arbitrary File Read](https://junglewise.ai/threats/cve-2016-9605-cobbler-arbitrary-file-read) (low, CVSS 3, published 2 Jul 2026) - [CVE-2011-4952: PYSEC-2026-624 - Cobbler Web Interface Lacks CSRF Protection](https://junglewise.ai/threats/cve-2011-4952-cobbler-web-interface-lacks-csrf-protection) (low, CVSS 3.1, published 2 Jul 2026) - [CVE-2024-47533: cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes](https://junglewise.ai/threats/cve-2024-47533-cobbler-allows-anyone-to-connect-to-cobbler-xml-rpc-server-with) (critical, CVSS 9.8, published 18 Nov 2024) - [CVE-2017-1000469: Cobbler vulnerable to arbitrary code execution](https://junglewise.ai/threats/cve-2017-1000469-cobbler-vulnerable-to-arbitrary-code-execution) (critical, CVSS 9.8, published 14 May 2022) - [CVE-2018-10931: Cobbler has Exposed Dangerous Method or Function](https://junglewise.ai/threats/cve-2018-10931-cobbler-has-exposed-dangerous-method-or-function) (critical, CVSS 9.8, published 13 May 2022) - [CVE-2018-1000226: Cobbler Improper Validation of Security Tokens](https://junglewise.ai/threats/cve-2018-1000226-cobbler-improper-validation-of-security-tokens) (critical, CVSS 9.8, published 13 May 2022) - [CVE-2022-0860: PYSEC-2022-177 - Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.](https://junglewise.ai/threats/cve-2022-0860-improper-authorization-in-cobbler) (low, CVSS 3, published 11 Mar 2022) - [CVE-2021-45083: Incorrect Default Permissions in Cobbler](https://junglewise.ai/threats/cve-2021-45083-incorrect-default-permissions-in-cobbler) (low, CVSS 3.1, published 20 Feb 2022) - [CVE-2021-45082: Command Injection in Cobbler](https://junglewise.ai/threats/cve-2021-45082-command-injection-in-cobbler) (low, CVSS 3.1, published 19 Feb 2022) - [CVE-2021-40325: PYSEC-2021-375 - Cobbler before 3.3.0 allows authorization bypass for modification of settings.](https://junglewise.ai/threats/cve-2021-40325-cobbler-before-3-3-0-allows-authorization-bypass-for-modification) (low, CVSS 3.1, published 4 Oct 2021) - [CVE-2021-40324: PYSEC-2021-374 - Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.](https://junglewise.ai/threats/cve-2021-40324-cobbler-before-3-3-0-allows-arbitrary-file-write-operations-via) (low, CVSS 3.1, published 4 Oct 2021) - [CVE-2021-40323: Cobbler before 3.3.0 allows log poisoning](https://junglewise.ai/threats/cve-2021-40323-cobbler-before-3-3-0-allows-log-poisoning) (low, CVSS 3.1, published 4 Oct 2021) ## Most severe cobbler (PyPI) vulnerabilities - [CVE-2018-10931: Cobbler has Exposed Dangerous Method or Function](https://junglewise.ai/threats/cve-2018-10931-cobbler-has-exposed-dangerous-method-or-function) (critical, CVSS 9.8, published 13 May 2022) - [CVE-2018-1000226: Cobbler Improper Validation of Security Tokens](https://junglewise.ai/threats/cve-2018-1000226-cobbler-improper-validation-of-security-tokens) (critical, CVSS 9.8, published 13 May 2022) - [CVE-2017-1000469: Cobbler vulnerable to arbitrary code execution](https://junglewise.ai/threats/cve-2017-1000469-cobbler-vulnerable-to-arbitrary-code-execution) (critical, CVSS 9.8, published 14 May 2022) - [CVE-2024-47533: cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes](https://junglewise.ai/threats/cve-2024-47533-cobbler-allows-anyone-to-connect-to-cobbler-xml-rpc-server-with) (critical, CVSS 9.8, published 18 Nov 2024) - [CVE-2021-40323: Cobbler before 3.3.0 allows log poisoning](https://junglewise.ai/threats/cve-2021-40323-cobbler-before-3-3-0-allows-log-poisoning) (low, CVSS 3.1, published 4 Oct 2021) - [CVE-2021-40324: PYSEC-2021-374 - Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.](https://junglewise.ai/threats/cve-2021-40324-cobbler-before-3-3-0-allows-arbitrary-file-write-operations-via) (low, CVSS 3.1, published 4 Oct 2021) - [CVE-2021-40325: PYSEC-2021-375 - Cobbler before 3.3.0 allows authorization bypass for modification of settings.](https://junglewise.ai/threats/cve-2021-40325-cobbler-before-3-3-0-allows-authorization-bypass-for-modification) (low, CVSS 3.1, published 4 Oct 2021) - [CVE-2011-4952: PYSEC-2026-624 - Cobbler Web Interface Lacks CSRF Protection](https://junglewise.ai/threats/cve-2011-4952-cobbler-web-interface-lacks-csrf-protection) (low, CVSS 3.1, published 2 Jul 2026) - [CVE-2021-45082: Command Injection in Cobbler](https://junglewise.ai/threats/cve-2021-45082-command-injection-in-cobbler) (low, CVSS 3.1, published 19 Feb 2022) - [CVE-2021-45083: Incorrect Default Permissions in Cobbler](https://junglewise.ai/threats/cve-2021-45083-incorrect-default-permissions-in-cobbler) (low, CVSS 3.1, published 20 Feb 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "cobbler (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/cobbler, 13 November 2026.