rootpwn

medium · CVSS v3 5.9

CVE-2026-91147

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Serv…

Description

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Scores

Severity
medium
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77608

Semantic MediaWiki extension for MediaWiki had a reflected XSS vulnerability due to insufficient output encoding of the 'value' parameter. This flaw could allow attackers to inject malicious scripts into wiki pages or error messages. The issue is fixed in version 7.2.0.

View analysis

medium

CVE-2026-77609

Semantic MediaWiki extension allows open redirect via Special:URIResolver. Attackers can craft subpages that redirect to arbitrary external URLs, enabling phishing. The flaw exists in versions prior to 7.2.0.

View analysis

medium

CVE-2026-77610

Semantic MediaWiki extension allows storing data in wiki pages. Prior to version 7.2.0, debug output from queries can be reflected as raw HTML, enabling reflected XSS. This affects any MediaWiki site using the extension and allows attackers to inject scripts via anonymous requests.

View analysis