Composer cockpit-hq/cockpit has 26 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-1025 | Cockpit Arbitrary File Upload | high | 7.5 | <2.4.1 | 2.4.1 |
| CVE-2023-4451 | Cockpit Cross-site Scripting vulnerability | medium | 6.1 | <=2.6.3 | – |
| CVE-2022-2818 | Cockpit Content Platform vulnerable to 2FA bypass | high | 8.8 | <2.2.2 | 2.2.2 |
| CVE-2023-4195 | Cockpit PHP Remote File Inclusion vulnerability | critical | 9.9 | <2.6.3 | 2.6.3 |
| CVE-2023-41564 | Cockpit CMS arbitrary file upload vulnerability | medium | 6.1 | <=2.6.3 | – |
| CVE-2023-1313 | cockpit-hq/cockpit is vulnerable to unrestricted file uploads | high | 8.8 | <2.4.1 | 2.4.1 |
| CVE-2023-37649 | Cockpit CMS vulnerable to incorrect access control | high | 7.5 | <2.6.0 | 2.6.0 |
| CVE-2026-38993 | Cockpit is vulnerable to directory traversal | medium | 6.5 | <2.14.0 | 2.14.0 |
| CVE-2024-4825 | Cockpit CMS contains an arbitrary file upload vulenrability | critical | 9.8 | <2.7.0 | 2.7.0 |
| CVE-2023-4422 | Cockpit Cross-site Scripting vulnerability | medium | 6.8 | <2.6.3 | 2.6.3 |
| CVE-2023-4321 | Cockpit Cross-site Scripting vulnerability | high | 8.3 | <=2.6.2 | – |
| CVE-2023-4432 | Cockpit Cross-site Scripting vulnerability | high | 8.3 | <=2.6.3 | – |
| CVE-2023-4395 | Cockpit Cross-site Scripting vulnerability | high | 8.1 | <=2.6.3 | – |
| CVE-2023-4433 | Cockpit Cross-site Scripting vulnerability | high | 8.3 | <=2.6.3 | – |
| CVE-2023-37650 | Cockpit CMS Cross-Site Request Forgery vulnerability | high | 8.8 | <2.6.0 | 2.6.0 |
| CVE-2023-4196 | Cockpit Cross-site Scripting vulnerability | high | 8.3 | <2.6.3 | 2.6.3 |
| CVE-2026-38992 | Cockpit is vulnerable to arbitrary code execution | critical | 9.8 | <2.14.0 | 2.14.0 |
| CVE-2026-31891 | Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() | high | 7.7 | <2.13.5 | 2.13.5 |
| CVE-2026-38991 | Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type | high | 8.8 | <2.14.0 | 2.14.0 |
| CVE-2023-0780 | Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit | medium | 5.4 | <2.3.9 | 2.3.9 |
| CVE-2025-7053 | Cockpit - Content Platform vulnerable to XSS through name or email argument names | low | 3.5 | <2.11.4 | 2.11.4 |
| CVE-2023-1160 | Cockpit Uses Platform-Dependent Third Party Components | medium | 5.5 | <=2.3.9 | – |
| CVE-2023-0759 | privilege chaining in cockpit-hq/cockpit | high | 8.8 | <2.3.8 | 2.3.8 |
| CVE-2024-2001 | Cockpit CMS Cross-Site Scripting vulnerability | medium | 5.5 | =2.7.0 | – |
| CVE-2026-6626 | Cockpit has NoSQL Injection Through Content Aggregation Pipelines | medium | 6.3 | <2.14.0 | 2.14.0 |
| CVE-2026-23695 | Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option | medium | 5.4 | <=2.14.0 | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked