https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T06:34:57.433317+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:2008 ALSA-2022:2008 — Moderate: cockpit security, bug fix, and enhancement update 2026-10-12T06:34:57.440122+00:00

Affected: AlmaLinux:8: cockpit, AlmaLinux:8: cockpit-bridge, AlmaLinux:8: cockpit-doc, AlmaLinux:8: cockpit-system, AlmaLinux:8: cockpit-ws

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

The following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)

Security Fix(es):

* cockpit: authenticates with revoked certificates (CVE-2021-3698)

* cockpit: pages vulnerable to clickjacking (CVE-2021-3660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2021-04029 bdu:2021-04029 2026-10-12T06:34:57.440179+00:00 bdu:2021-04029 https://cve.radiocsirt.org/vuln/cnvd-2022-22269 cnvd-2022-22269 2026-10-12T06:34:57.440195+00:00 cnvd-2022-22269 https://cve.radiocsirt.org/vuln/euvd-2026-21046 EUVD-2026-21046 2026-10-12T06:34:57.440207+00:00 EUVD-2026-21046 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3660 fkie_cve-2021-3660 2026-10-12T06:34:57.440216+00:00

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

 https://cve.radiocsirt.org/vuln/ghsa-5m9v-2hhc-h2wj GHSA-5m9v-2hhc-h2wj 2026-10-12T06:34:57.440237+00:00

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

 https://cve.radiocsirt.org/vuln/gsd-2021-3660 gsd-2021-3660 2026-10-12T06:34:57.440251+00:00 gsd-2021-3660 https://cve.radiocsirt.org/vuln/msrc_cve-2021-3660 msrc_CVE-2021-3660 — Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a co… 2026-10-12T06:34:57.440260+00:00 msrc_CVE-2021-3660 https://cve.radiocsirt.org/vuln/oesa-2021-1359 OESA-2021-1359 — cockpit security update 2026-10-12T06:34:57.440274+00:00

Affected: openEuler:20.03-LTS-SP1: cockpit, openEuler:20.03-LTS-SP2: cockpit

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fix(es): Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an HTML entry. This may be used by a malicious website in clickjacking or similar attacks.(CVE-2021-3660)

 https://cve.radiocsirt.org/vuln/rhsa-2022:2008 RHSA-2022:2008 — Red Hat Security Advisory: cockpit security, bug fix, and enhancement update 2026-10-12T06:34:57.440299+00:00

cockpit: pages vulnerable to clickjacking cockpit: authenticates with revoked certificates

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3660 UBUNTU-CVE-2021-3660 2026-10-12T06:34:57.440315+00:00

Affected: Ubuntu:18.04:LTS: cockpit, Ubuntu:20.04:LTS: cockpit

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.