Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Mar 25, 2026Mr. Cobbler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22502 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mr. Cobbler mr-cobbler allows PHP Local File Inclusion.This issue affects Mr. Cobbler: from n/a through <= 1.1.9.
- Product
- Mr. Cobbler
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Mr. Cobbler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in CVE-2024-47533 · Other software · cobbler · reported by GitHubCritical 9.8
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
- Product
- cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.CVE-2022-0860 · Other software · cobbler · reported by security@huntr.devCritical 9.1
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
- Product
- cobbler/cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2022An issue was discovered in Cobbler before 3.3.1.CVE-2021-45083 · Other software · Cobbler Project · reported by MITREHigh 7.1
An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Feb 20, 2022An issue was discovered in Cobbler through 3.3.1.CVE-2021-45081 · Other software · Cobbler Project · reported by MITREMedium 5.9
An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.suse.com
Feb 18, 2022An issue was discovered in Cobbler before 3.3.1.CVE-2021-45082 · Other software · Cobbler Project · reported by MITREHigh 7.8
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Oct 4, 2021Cobbler before 3.3.0 allows authorization bypass for modification of settings.CVE-2021-40325 · Other software · Cobbler Project · reported by MITREHigh 7.5
Cobbler before 3.3.0 allows authorization bypass for modification of settings.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.CVE-2021-40324 · Other software · Cobbler Project · reported by MITREHigh 7.5
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.CVE-2021-40323 · Other software · Cobbler Project · reported by MITRECritical 9.8
Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2019A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.CVE-2012-2092 · Other software · Ubuntu · reported by Red HatMedium 5.9
A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 19, 2019cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHECVE-2011-4954 · Other software · cobbler · reported by Red HatHigh 7.8
cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE
- Product
- cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Nov 19, 2019cobbler: Web interface lacks CSRF protection when using Django frameworkCVE-2011-4952 · Other software · cobbler · reported by Red HatHigh 8.8
cobbler: Web interface lacks CSRF protection when using Django framework
- Product
- cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Aug 22, 2018A flaw was found in cobbler software component version 2.6.11-1.CVE-2016-9605 · Other software · The cobbler Project · reported by Red HatMedium 6.1
A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
- Product
- cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Aug 20, 2018Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable CVE-2018-1000226 · Other software · Cobblerd · reported by MITRECritical 9.8
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commovermeyer.com
Aug 20, 2018Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable CVE-2018-1000225 · Other software · Cobblerd · reported by MITREMedium 6.1
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commovermeyer.com
Aug 9, 2018It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.CVE-2018-10931 · Other software · The Cobbler Project · reported by Red HatCritical 9.8
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
- Product
- cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jan 3, 2018Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.CVE-2017-1000469 · Other software · Cobbler Project · reported by MITRECritical 9.8
Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2014The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use CVE-2011-4953 · Other software · Cobbler Project · reported by Red HatMedium 6.8
The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgbugs.launchpad.net
May 13, 2014Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the KickCVE-2014-3225 · Other software · Cobblerd · reported by MITREMedium 4
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 15, 2012Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1)CVE-2012-2395 · Other software · Michael Dehaan · reported by Red HatHigh 7.5
Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 30, 2011SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privilegeCVE-2011-1551 · Other software · Novell · reported by MITREMedium 6.9
SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon.
- Product
- Opensuse Factory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comexchange.xforce.ibmcloud.com
Dec 9, 2010Cobbler before 2.0.4 uses an incorrect umask value, which allows local users to have an unspecified impact by leveraging world writable permissions for files anCVE-2010-4512 · Other software · Michael Dehaan · reported by MITREHigh 7.2
Cobbler before 2.0.4 uses an incorrect umask value, which allows local users to have an unspecified impact by leveraging world writable permissions for files and directories.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpeople.fedoraproject.orgsecunia.com
Dec 9, 2010template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template enCVE-2010-2235 · Other software · Michael Dehaan · reported by Red HatHigh 8.5
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpeople.fedoraproject.orgredhat.com
Dec 9, 2010Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by usingCVE-2009-5021 · Other software · Michael Dehaan · reported by MITREHigh 7.5
Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by using this password.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpeople.fedoraproject.orgexchange.xforce.ibmcloud.com
Aug 12, 2009The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kicksCVE-2008-6954 · Other software · Michael Dehaan · reported by MITREHigh 9
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Product
- Cobbler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreshmeat.netosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.