Vulnerabilities

TI-2026-40093 CVE-2026-55548 · GHSA-8xjq-pr36-ccgf

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

MEDIUM 53

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-07-16 Fixed in 5.12.8, 5.13.2 CWE-284

TI-2026-34277 CVE-2026-46621 · GHSA-2g95-6x5q-xjwj

Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

HIGH 74

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01116 Published 2026-07-16 Fixed in 5.12.7 CWE-94

TI-2026-34240 CVE-2026-46562 · GHSA-vmwp-vh32-rj75

Yamcs: Remote Code Execution via Mission Database algorithm override

HIGH 82

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00976 Published 2026-07-16 Fixed in 5.12.7 CWE-470

TI-2026-32532 CVE-2026-44632 · GHSA-524g-x36v-9wm6

Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

HIGH 74

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01116 Published 2026-07-16 Fixed in 5.12.7 CWE-94

TI-2026-32507 CVE-2026-44596 · GHSA-w5r6-mcgq-7pq4

Yamcs: No Rate Limiting on Authentication Endpoint

HIGH 81

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0206 Published 2026-07-16 Fixed in 5.12.7 CWE-307

TI-2026-32506 CVE-2026-44595 · GHSA-p2rj-mrmc-9w29

Yamcs: Unauthorized user enumeration via IAM API endpoints

MEDIUM 53

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01057 Published 2026-07-16 Fixed in 5.12.7 CWE-862

TI-2023-24271 CVE-2023-45281 · GHSA-g92q-cp9m-6xg3

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.

LOW 28

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00479 Published 2023-10-19 No fix listed CWE-79

TI-2023-24270 CVE-2023-45280 · GHSA-643f-hpcc-2gv8

Yamcs 5.8.6 allows XSS (issue 2 of 2).

LOW 25

Yamcs 5.8.6 allows XSS (issue 2 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00609 Published 2023-10-19 Fixed in 5.8.7 CWE-79

TI-2023-24269 CVE-2023-45279 · GHSA-4cqv-q33x-wfxw

Yamcs 5.8.6 allows XSS (issue 1 of 2).

LOW 25

Yamcs 5.8.6 allows XSS (issue 1 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00497 Published 2023-10-19 Fixed in 5.8.7 CWE-79

TI-2023-24268 CVE-2023-45278 · GHSA-43fw-536j-w37j

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6…

MEDIUM 43

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01831 Published 2023-10-19 Fixed in 5.8.7 CWE-22

TI-2023-24267 CVE-2023-45277 · GHSA-w4m2-qmh3-2g8f

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2).

LOW 35

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01218 Published 2023-10-19 Fixed in 5.8.7 CWE-22

Vulnerabilities

Filters