https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T18:01:07.782831+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:2008 ALSA-2022:2008 β€” Moderate: cockpit security, bug fix, and enhancement update 2026-10-10T18:01:07.787947+00:00

Affected: AlmaLinux:8: cockpit, AlmaLinux:8: cockpit-bridge, AlmaLinux:8: cockpit-doc, AlmaLinux:8: cockpit-system, AlmaLinux:8: cockpit-ws

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

The following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)

Security Fix(es):

* cockpit: authenticates with revoked certificates (CVE-2021-3698)

* cockpit: pages vulnerable to clickjacking (CVE-2021-3660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/euvd-2026-20998 EUVD-2026-20998 2026-10-10T18:01:07.788011+00:00 EUVD-2026-20998 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3698 fkie_cve-2021-3698 2026-10-10T18:01:07.788028+00:00

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

 https://cve.radiocsirt.org/vuln/ghsa-w9ph-5m4x-c49r GHSA-w9ph-5m4x-c49r 2026-10-10T18:01:07.788052+00:00

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

 https://cve.radiocsirt.org/vuln/gsd-2021-3698 gsd-2021-3698 2026-10-10T18:01:07.788069+00:00 gsd-2021-3698 https://cve.radiocsirt.org/vuln/msrc_cve-2021-3698 msrc_CVE-2021-3698 β€” A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by th… 2026-10-10T18:01:07.788080+00:00 msrc_CVE-2021-3698 https://cve.radiocsirt.org/vuln/rhsa-2022:2008 RHSA-2022:2008 β€” Red Hat Security Advisory: cockpit security, bug fix, and enhancement update 2026-10-10T18:01:07.788097+00:00

cockpit: pages vulnerable to clickjacking cockpit: authenticates with revoked certificates

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3698 UBUNTU-CVE-2021-3698 2026-10-10T18:01:07.788114+00:00

Affected: Ubuntu:20.04:LTS: cockpit

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.