Technology · Packagist

cockpit-hq/cockpit (Packagist) vulnerabilities

Updated 28 September 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 26 vulnerabilities in cockpit-hq/cockpit (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-23695, was published on 15 May 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

About cockpit-hq/cockpit (Packagist)

A self-hosted content management system designed for managing structured content.

Homepage

Latest cockpit-hq/cockpit (Packagist) vulnerabilities

CVE-2026-23695: Cockpit CMS stored XSS in Set field type Display templatemediumCVSS 5.4EPSS 0.1%15 May 2026
CVE-2026-38991: Cockpit Vulnerable to Unrestricted Upload of File with Dangerous TypelowCVSS 3.1EPSS 0.5%29 Apr 2026
CVE-2026-38993: Cockpit CMS directory traversal in Buckets componentmediumCVSS 6.5EPSS 1.0%29 Apr 2026
CVE-2026-38992: Cockpit is vulnerable to arbitrary code executionlowCVSS 3.1EPSS 0.7%29 Apr 2026
CVE-2026-6626: Cockpit has NoSQL Injection Through Content Aggregation PipelinesmediumCVSS 6.3EPSS 0.4%20 Apr 2026
CVE-2026-31891: Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()lowCVSS 3.1EPSS 0.4%17 Mar 2026
CVE-2025-7053: Cockpit - Content Platform vulnerable to XSS through name or email argument nameslowCVSS 3.1EPSS 0.3%4 Jul 2025
CVE-2025-1025: Cockpit Arbitrary File UploadlowCVSS 3.1EPSS 18.9%5 Feb 2025
CVE-2024-4825: Cockpit CMS contains an arbitrary file upload vulenrabilitylowCVSS 3.1EPSS 0.7%14 May 2024
CVE-2024-2001: Cockpit CMS Cross-Site Scripting vulnerabilitylowCVSS 3.1EPSS 0.3%29 Feb 2024
CVE-2023-41564: Cockpit CMS arbitrary file upload vulnerabilitylowCVSS 3.1EPSS 1.0%9 Sep 2023
CVE-2023-4451: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3.1EPSS 2.5%20 Aug 2023
CVE-2023-4433: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3EPSS 0.6%19 Aug 2023
CVE-2023-4432: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3EPSS 0.6%19 Aug 2023
CVE-2023-4422: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3EPSS 0.6%18 Aug 2023
CVE-2023-4395: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3EPSS 0.6%17 Aug 2023
CVE-2023-4321: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3EPSS 0.6%14 Aug 2023
CVE-2023-4195: Cockpit PHP Remote File Inclusion vulnerabilitylowCVSS 3EPSS 1.1%6 Aug 2023
CVE-2023-4196: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3EPSS 0.5%6 Aug 2023
CVE-2023-37650: Cockpit CMS Cross-Site Request Forgery vulnerabilitylowCVSS 3.1EPSS 0.5%20 Jul 2023
CVE-2023-37649: Cockpit CMS vulnerable to incorrect access controllowCVSS 3.1EPSS 0.9%20 Jul 2023
CVE-2023-1313: cockpit-hq/cockpit is vulnerable to unrestricted file uploadslowCVSS 3.1EPSS 1.0%10 Mar 2023
CVE-2023-1160: Cockpit Uses Platform-Dependent Third Party ComponentslowCVSS 3.1EPSS 0.4%3 Mar 2023
CVE-2023-0780: Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpitlowCVSS 3.1EPSS 0.4%11 Feb 2023
CVE-2023-0759: privilege chaining in cockpit-hq/cockpitlowCVSS 3.1EPSS 0.3%9 Feb 2023

Most severe cockpit-hq/cockpit (Packagist) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2026-38993: Cockpit CMS directory traversal in Buckets componentmediumCVSS 6.5EPSS 1.0%29 Apr 2026
CVE-2026-6626: Cockpit has NoSQL Injection Through Content Aggregation PipelinesmediumCVSS 6.3EPSS 0.4%20 Apr 2026
CVE-2026-23695: Cockpit CMS stored XSS in Set field type Display templatemediumCVSS 5.4EPSS 0.1%15 May 2026
CVE-2025-1025: Cockpit Arbitrary File UploadlowCVSS 3.1EPSS 18.9%5 Feb 2025
CVE-2023-4451: Cockpit Cross-site Scripting vulnerabilitylowCVSS 3.1EPSS 2.5%20 Aug 2023
CVE-2022-2818: Cockpit Content Platform vulnerable to 2FA bypasslowCVSS 3.1EPSS 1.7%16 Aug 2022
CVE-2023-1313: cockpit-hq/cockpit is vulnerable to unrestricted file uploadslowCVSS 3.1EPSS 1.0%10 Mar 2023
CVE-2023-41564: Cockpit CMS arbitrary file upload vulnerabilitylowCVSS 3.1EPSS 1.0%9 Sep 2023
CVE-2023-37649: Cockpit CMS vulnerable to incorrect access controllowCVSS 3.1EPSS 0.9%20 Jul 2023
CVE-2026-38992: Cockpit is vulnerable to arbitrary code executionlowCVSS 3.1EPSS 0.7%29 Apr 2026

Vulnerabilities per week

The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
6 Jul 2026		0	0
13 Jul 2026		0	0
20 Jul 2026		0	0
27 Jul 2026		0	0
3 Aug 2026		0	0
10 Aug 2026		0	0
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/cockpit-hq-cockpit.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "cockpit-hq/cockpit (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/cockpit-hq-cockpit, 28 September 2026.