These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-57856 is a path traversal vulnerability in Cockpit CMS. The Bucket file storage API (/system/buckets/api) in Cockpit CMS is vulnerable to path traversal attacks. The vulnerability allows an authenticated low-privileged user to list, upload, and delete files across all buckets, including those belonging to other users or roles. This vulnerability has a high severity and requires immediate attentio [truncated]
The CVE record indicates that Cockpit CMS has a missing authorization vulnerability in its Bucket file storage API. The api() method in modules/System/Controller/Buckets.php executes bucket commands without performing any ACL or role check, allowing any authenticated user to perform all bucket operations. This vulnerability can have significant operational impacts, as it allows unauthorized access to sens [truncated]
A stored cross-site scripting (XSS) vulnerability exists in Cockpit CMS through version 2.14.0. The vulnerability resides in the Set field type's Display template option, where template strings are processed by the $interpolate function using new Function() and subsequently rendered via Vue's v-html directive without adequate sanitization. An attacker possessing content/:models/manage permissions can inje [truncated]