These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-105217 is a vulnerability in Cockpit CMS versions 2.12.0 before 2.14.1, where TLS certificate verification is disabled in the cron.php web worker restart request. This allows network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and start the web worker.
The CVE-2026-73680 vulnerability in Cockpit CMS 2.14.0 and prior allows authenticated users with assets/upload permission to execute arbitrary commands by uploading a video file with a filename containing shell metacharacters. This command injection vulnerability is achieved through the unsanitized filename being interpolated into a shell command executed via Process::fromShellCommandline() before the slu [truncated]
CVE-2026-57856 is a path traversal vulnerability in Cockpit CMS. The Bucket file storage API (/system/buckets/api) in Cockpit CMS is vulnerable to path traversal attacks. The vulnerability allows an authenticated low-privileged user to list, upload, and delete files across all buckets, including those belonging to other users or roles. This vulnerability has a high severity and requires immediate attentio [truncated]
The CVE record indicates that Cockpit CMS has a missing authorization vulnerability in its Bucket file storage API. The api() method in modules/System/Controller/Buckets.php executes bucket commands without performing any ACL or role check, allowing any authenticated user to perform all bucket operations. This vulnerability can have significant operational impacts, as it allows unauthorized access to sens [truncated]
A stored cross-site scripting (XSS) vulnerability exists in Cockpit CMS through version 2.14.0. The vulnerability resides in the Set field type's Display template option, where template strings are processed by the $interpolate function using new Function() and subsequently rendered via Vue's v-html directive without adequate sanitization. An attacker possessing content/:models/manage permissions can inje [truncated]