https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:45:00 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:7383 <p><strong>Affected:</strong> AlmaLinux:10: cockpit-bridge, AlmaLinux:10: cockpit-doc, AlmaLinux:10: cockpit-packagekit, AlmaLinux:10: cockpit-storaged, AlmaLinux:10: cockpit-system</p> <p>Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.</p> <p>Security Fix(es):</p> <p>* cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:10: cockpit-bridge, AlmaLinux:10: cockpit-doc, AlmaLinux:10: cockpit-packagekit, AlmaLinux:10: cockpit-storaged, AlmaLinux:10: cockpit-system</p> <p>Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.</p> <p>Security Fix(es):</p> <p>* cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:7383 https://cve.radiocsirt.org/vuln/bdu:2026-05259 bdu:2026-05259 https://cve.radiocsirt.org/vuln/bdu:2026-05259 https://cve.radiocsirt.org/vuln/euvd-2026-344038 EUVD-2026-344038 https://cve.radiocsirt.org/vuln/euvd-2026-344038 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4631 <p>Cockpit&#39;s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.</p> <p>Cockpit&#39;s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-4631 https://cve.radiocsirt.org/vuln/ghsa-rq49-h582-83m7 <p>Cockpit&#39;s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.</p> <p>Cockpit&#39;s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-rq49-h582-83m7 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10531-1 <p>cockpit-360-1.1 on GA media</p> <p>cockpit-360-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10531-1 https://cve.radiocsirt.org/vuln/rhsa-2026:7381 <p>cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection</p> <p>cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection</p> https://cve.radiocsirt.org/vuln/rhsa-2026:7381 https://cve.radiocsirt.org/vuln/suse-su-2026:21106-1 <p>Security update for cockpit</p> <p>Security update for cockpit</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21106-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-4631 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: cockpit, Ubuntu:20.04:LTS: cockpit, Ubuntu:22.04:LTS: cockpit, Ubuntu:24.04:LTS: cockpit, Ubuntu:25.10: cockpit, Ubuntu:26.04:LTS: cockpit</p> <p>Cockpit&#39;s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: cockpit, Ubuntu:20.04:LTS: cockpit, Ubuntu:22.04:LTS: cockpit, Ubuntu:24.04:LTS: cockpit, Ubuntu:25.10: cockpit, Ubuntu:26.04:LTS: cockpit</p> <p>Cockpit&#39;s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-4631 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1052 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1052