OpenC3 cosmos vulnerabilities
12 published CVEs name OpenC3 cosmos among the affected products.
- 12Published CVEs12 of them scored
- 9Last 12 monthspublished in the last year
- 4Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-77602
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
OpenC3 · cosmos
Critical9.9 - CVE-2026-77394
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
OpenC3 · cosmos
High7.6 - CVE-2026-77601
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
OpenC3 · cosmos
High8.8 - CVE-2026-42088
OpenC3 COSMOS: Administrative Actions via the Script Runner Tool
OpenC3 · cosmos
Critical9.6 - CVE-2026-42087
OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
OpenC3 · cosmos
Critical9.6 - CVE-2026-42086
OpenC3 COSMOS: Self-XSS in the Command Sender
OpenC3 · cosmos
Medium4.6 - CVE-2026-42085
OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames
OpenC3 · cosmos
Medium4.3 - CVE-2026-42084
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
OpenC3 · cosmos
High8.1 - CVE-2025-68271
Unauthenticated Remote Code Execution in openc3-api
OpenC3 · cosmos
Critical10.0 - CVE-2024-47529
OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
OpenC3 · cosmos
Medium4.8