Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: sgoudelis Clear all filters
TI-2026-85947 CVE-2026-123485 · GHSA-j9g5-775w-7p2x

Credential disclosure in Ground Station via get-orbital-sources

Priority MEDIUM 64

Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00327 Published 2026-11-06 Fixed in 0.8.20 CWE-862
TI-2026-65619 CVE-2026-103244 · GHSA-wwmv-hj9m-4mcc

ground-station before 0.8.0 Authentication Bypass via setup.restore

Priority HIGH 81

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00565 Published 2026-10-01 Fixed in 0.8.0 CWE-306
TI-2026-38532 CVE-2026-53451

Path traversal in sgoudelis ground-station

Priority HIGH 82

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01082 Published 2026-08-19 Fixed in 0.4.13 CWE-22