CVE-2025-13465VulnerabilityPublished 21 Jul 2026Updated 10 Nov 2026

SUSE · Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions

Affects SUSESource GCVE Database

Compare

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : patch SUSE as a priority.

Data as of 10 Nov 2026, 20:06 UTC

Severity

Critical

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch: Available – fixed in 4.8

Exploitation evidence

Disclosed: evidence found.
CVE published 21 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

Description

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues: Security issues fixed: - CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325). - CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829). - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840). - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641). - CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015). Non security issues fixed: - cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210). - cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149). Changes for cockpit: - Update to 364. - Update to 361 (jsc#PED-15706/jsc#CPT-183): * Remove all "Mount" actions in Anaconda mode * Dependency updates - Update to 360: * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631 * ws: support loading a custom login page - Update to 358: * Networking: Add Wi-Fi support * Cockpit Client updated to GTK 4 * Bugfixes and translation updates - Update to 357: * lib: Use browser context menu on shift * bridge: support Python 3.14 on old kernels (RHEL 8) - Update to 356: * systemd: Allow editing timers created by Cockpit * Convert license headers to SPDX format - Update to 355: * ws: Remove obsolete pam_cockpit_cert module * shell: add StartTransientUnit as a sudo alternative Changes for cockpit-machines: - Update to 354. - Update to 352: - Improvements to the "Add disk" and "Create Volume" dialogs. - Update suse_version requirement to function with the planned bump (jsc#PED-15820). - Drop explict dependency on libvirt (bsc#1258040, bsc#1236149). - Update to 348: * Translation updates * Convert license headers to SPDX format * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl - Update to 347: * Bug fixes and translation updates - Fix esbuild for ppc64le (bsc#1257698). Changes for cockpit-packages: - Update to version 5: * Support transactional systems * Improve error/success messages * Translation updates - Patch esbuild to use native runtime on ppc64 (bsc#1257698). Changes for cockpit-podman: - Update to 128. - Fix esbuild for ppc64le (bsc#1257698). Changes for cockpit-repos: - Update to 4.8. - Patch esbuild to use native runtime on ppc64 (bsc#1257698). Changes for cockpit-subscriptions: - Update to version 16.2 (bsc#1257033). - Patch esbuild to use native runtime on ppc64 (bsc#1257698).

References

Community reviews

Loading reviews…

Exploitation evidence

Description

Public exploits and detectionGitHub proofs of concept

Technical details

References

Community reviews

Related threats