PatchTheCVE: cockpit-projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-3698: A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification perforhttps://patchthecve.com/cve/CVE-2021-3698.htmlhttps://patchthecve.com/cve/CVE-2021-3698.htmlWed, 17 Jun 2026 04:05:35 +0000HIGH 7.5: A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or theCVE-2021-3660: Cockpit (and its plugins) do not seem to protect itself against clickjackinghttps://patchthecve.com/cve/CVE-2021-3660.htmlhttps://patchthecve.com/cve/CVE-2021-3660.htmlWed, 17 Jun 2026 04:05:31 +0000MEDIUM 4.3: Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.CVE-2020-35850: An SSRF issue was discovered in cockpit-project.org Cockpit 234https://patchthecve.com/cve/CVE-2020-35850.htmlhttps://patchthecve.com/cve/CVE-2020-35850.htmlWed, 17 Jun 2026 03:14:27 +0000MEDIUM 6.5: An SSRF issue was discovered in cockpit-project.org Cockpit 234. NOTE: this is unrelated to the Agentejo Cockpit product. NOTE: the vendor states "I don't think [it] is a big real-life issue.