Vulnerabilities

TI-2026-40107 CVE-2026-55566 · GHSA-9272-wg2r-7xmx

Yamcs: DOM XSS in Extension Routing

MEDIUM 53

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0038 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-79

TI-2026-40106 CVE-2026-55565 · GHSA-c64q-hj4j-375f

Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

HIGH 76

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0065 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-94

TI-2026-40103 CVE-2026-55559 · GHSA-73mf-m39p-wpm9

Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

HIGH 82

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00784 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-1336

TI-2026-40096 CVE-2026-55552 · GHSA-9jg3-g3wh-w9pj

Yamcs: Unauthenticated Directory Traversal

MEDIUM 42

Yamcs is a mission control framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01722 Published 2026-08-28 Fixed in 5.12.0 CWE-22

TI-2026-40094 CVE-2026-55549 · GHSA-rxpg-wjf8-qv9c

Yamcs: Reflected XSS in the URL of the Authorize Endpoint

MEDIUM 62

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01305 Published 2026-08-28 Fixed in 5.9.4 CWE-79

TI-2026-40092 CVE-2026-55547 · GHSA-cvw4-55pp-3hfq

Improper authorization in yamcs

MEDIUM 53

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-285

TI-2026-40090 CVE-2026-55545 · GHSA-fwww-cp23-7f5g

Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

LOW 29

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00451 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-862

TI-2026-40067 CVE-2026-55521 · GHSA-962x-ccwf-8x6p

Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

HIGH 73

Yamcs is a mission control framework.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00523 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-862

TI-2026-40057 CVE-2026-55511 · GHSA-3g44-3m7x-cgg2

Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

HIGH 74

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00677 Published 2026-08-28 Fixed in 5.12.8, 5.13.2 CWE-94

TI-2026-40093 CVE-2026-55548 · GHSA-8xjq-pr36-ccgf

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

MEDIUM 53

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-07-16 Fixed in 5.12.8, 5.13.2 CWE-284

TI-2026-34277 CVE-2026-46621 · GHSA-2g95-6x5q-xjwj

Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

HIGH 74

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01116 Published 2026-07-16 Fixed in 5.12.7 CWE-94

TI-2026-34240 CVE-2026-46562 · GHSA-vmwp-vh32-rj75

Yamcs: Remote Code Execution via Mission Database algorithm override

HIGH 82

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00976 Published 2026-07-16 Fixed in 5.12.7 CWE-470

TI-2026-32532 CVE-2026-44632 · GHSA-524g-x36v-9wm6

Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

HIGH 74

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01116 Published 2026-07-16 Fixed in 5.12.7 CWE-94

TI-2026-32507 CVE-2026-44596 · GHSA-w5r6-mcgq-7pq4

Yamcs: No Rate Limiting on Authentication Endpoint

HIGH 81

Yamcs is a mission control framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0206 Published 2026-07-16 Fixed in 5.12.7 CWE-307

TI-2026-32506 CVE-2026-44595 · GHSA-p2rj-mrmc-9w29

Yamcs: Unauthorized user enumeration via IAM API endpoints

MEDIUM 53

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01057 Published 2026-07-16 Fixed in 5.12.7 CWE-862

TI-2026-30848 CVE-2026-42568 · GHSA-cqh3-jg8p-336j

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

LOW 22

Yamcs is a mission control framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01027 Published 2026-06-10 Fixed in 5.12.7 CWE-90

TI-2023-25599 CVE-2023-47311 · GHSA-75g5-m988-7348

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

LOW 28

An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00419 Published 2023-11-20 No fix listed CWE-1021

TI-2023-25022 CVE-2023-46471 · GHSA-7xqf-whj5-xm7f

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a…

MEDIUM 58

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00603 Published 2023-11-20 No fix listed CWE-79

TI-2023-25021 CVE-2023-46470 · GHSA-5m96-93vv-3v3x

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a…

LOW 25

Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00603 Published 2023-11-20 No fix listed CWE-79

TI-2023-24271 CVE-2023-45281 · GHSA-g92q-cp9m-6xg3

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.

LOW 28

An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00479 Published 2023-10-19 No fix listed CWE-79

TI-2023-24270 CVE-2023-45280 · GHSA-643f-hpcc-2gv8

Yamcs 5.8.6 allows XSS (issue 2 of 2).

LOW 25

Yamcs 5.8.6 allows XSS (issue 2 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00609 Published 2023-10-19 Fixed in 5.8.7 CWE-79

TI-2023-24269 CVE-2023-45279 · GHSA-4cqv-q33x-wfxw

Yamcs 5.8.6 allows XSS (issue 1 of 2).

LOW 25

Yamcs 5.8.6 allows XSS (issue 1 of 2).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00497 Published 2023-10-19 Fixed in 5.8.7 CWE-79

TI-2023-24268 CVE-2023-45278 · GHSA-43fw-536j-w37j

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6…

MEDIUM 43

Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE request.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01831 Published 2023-10-19 Fixed in 5.8.7 CWE-22

TI-2023-24267 CVE-2023-45277 · GHSA-w4m2-qmh3-2g8f

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2).

LOW 35

Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01218 Published 2023-10-19 Fixed in 5.8.7 CWE-22

Vulnerabilities

Filters