Priority HIGH 82
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00596 · Published 2025-06-13 · No fix listed CWE-521
Priority HIGH 82
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00607 · Published 2025-06-13 · No fix listed CWE-798
Priority HIGH 82
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01059 · Published 2025-06-13 · No fix listed CWE-94
Priority HIGH 78
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00886 · Published 2025-06-13 · No fix listed CWE-22
Priority HIGH 76
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00716 · Published 2026-09-23 · Fixed in 7.3.0 CWE-94
Priority HIGH 76
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.00341 · Published 2026-05-04 · Fixed in 7.0.0-rc3 CWE-250
Priority HIGH 76
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.00323 · Published 2026-05-04 · Fixed in 7.0.0-rc3 CWE-89
Priority HIGH 73
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00628 · Published 2026-09-23 · Fixed in 7.3.0 CWE-78
Priority HIGH 72
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00886 · Published 2025-06-13 · No fix listed CWE-22
Priority HIGH 72
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00522 · Published 2025-06-13 · No fix listed CWE-526
Priority HIGH 70
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00305 · Published 2026-05-04 · Fixed in 6.10.5, 7.0.0-rc3 CWE-620
Priority HIGH 66
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00417 · Published 2026-09-23 · Fixed in 7.3.0 CWE-79
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00338 · Published 2025-06-13 · No fix listed CWE-79
Priority MEDIUM 54
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.002 · Published 2026-05-04 · Fixed in 7.0.0 CWE-79
Priority MEDIUM 50
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00636 · Published 2026-01-13 · Fixed in 6.10.2 CWE-95
Priority LOW 26
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00912 · Published 2024-10-02 · Fixed in 5.19.0 CWE-22
Priority LOW 24
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 4.0MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00483 · Published 2024-10-02 · Fixed in 5.19.0 CWE-79
Priority LOW 22
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 4.0MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00353 · Published 2024-10-02 · Fixed in 5.19.0 CWE-312
Priority LOW 20
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00313 · Published 2026-05-04 · Fixed in 6.10.5, 7.0.0-rc3 CWE-23
THREATIST.IORead the docs