Nasa
65 CVEs across 15 Nasa products. Browse Nasa vulnerabilities, severities, and proof-of-concept exploits.
Nasa products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72579 | High | 7.5 | 2026-08-10 | An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci… |
CVE-2026-72577 | Critical | 9.8 | 2026-08-10 | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station ho… |
CVE-2026-18064 | High | 7.5 | 2026-07-30 | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reach… |
CVE-2026-15352 | High | 7.5 | 2026-07-16 | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fa… |
CVE-2018-25367 | Medium | 6.2 | 2026-05-25 | NASA openVSP 3.16.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in th… |
CVE-2026-41144 | Unrated | | 2026-04-22 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to version 4.2.0, the bounds… |
CVE-2026-5476 | Medium | 4.6 | 2026-04-03 | A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cf… |
CVE-2026-5475 | Medium | 5.5 | 2026-04-03 | A vulnerability was determined in NASA cFS up to 7.0.0. This impacts the function CFE_SB_TransmitMsg of the file cfe_sb_priv.c of the component CCSDS Header Si… |
CVE-2026-5474 | Medium | 6.3 | 2026-04-03 | A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the co… |
CVE-2026-5473 | Medium | 4.5 | 2026-04-03 | A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation lead… |
CVE-2026-22697 | High | 7.5 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-22027 | Medium | 6.0 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-22026 | High | 7.5 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-22025 | Low | 3.7 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-22024 | Medium | 5.3 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-22023 | High | 7.5 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-21900 | Medium | 5.9 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-21899 | Medium | 4.7 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-21898 | High | 8.2 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2026-21897 | High | 7.3 | 2026-01-10 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-64096 | High | 8.8 | 2025-10-30 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-59534 | High | 7.3 | 2025-09-23 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-54878 | High | 8.6 | 2025-08-11 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-46675 | Low | 3.5 | 2025-04-27 | In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking. |
CVE-2025-46674 | Low | 3.5 | 2025-04-27 | NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracl… |
CVE-2025-46673 | Medium | 4.9 | 2025-04-27 | NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security p… |
CVE-2025-46672 | Low | 3.5 | 2025-04-27 | NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking. |
CVE-2025-30356 | Critical | 9.8 | 2025-04-01 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-25374 | High | 7.5 | 2025-03-25 | In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causin… |
CVE-2025-25373 | Critical | 9.8 | 2025-03-25 | The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform. |
CVE-2025-25372 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module. |
CVE-2025-25371 | High | 7.5 | 2025-03-25 | NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system. |
CVE-2024-55030 | Critical | 9.8 | 2025-03-25 | A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. |
CVE-2024-55029 | Medium | 6.1 | 2025-03-25 | NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. |
CVE-2024-55028 | Critical | 9.8 | 2025-03-25 | A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file. |
CVE-2025-30216 | Critical | 9.4 | 2025-03-25 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29913 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29912 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29911 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29910 | High | 7.5 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-29909 | Critical | 9.8 | 2025-03-17 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2024-44912 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c). |
CVE-2024-44911 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c). |
CVE-2024-44910 | High | 7.5 | 2024-09-27 | NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c). |
CVE-2024-35061 | High | 7.3 | 2024-05-21 | NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. Wh… |
CVE-2024-35060 | High | 7.5 | 2024-05-21 | An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file. |
CVE-2024-35059 | High | 7.5 | 2024-05-21 | An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. |
CVE-2024-35058 | High | 7.5 | 2024-05-21 | An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. |
CVE-2024-35057 | High | 7.5 | 2024-05-21 | An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. |
CVE-2024-35056 | Critical | 9.8 | 2024-05-21 | NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions. |
CVE-2023-45885 | Medium | 5.4 | 2023-11-09 | Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in t… |
CVE-2023-45884 | Medium | 6.5 | 2023-11-09 | Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLay… |
CVE-2023-45282 | High | 7.5 | 2023-10-06 | In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action. |
CVE-2022-23054 | Medium | 6.1 | 2022-02-20 | Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the injection of malicious JavaScript into the… |
CVE-2022-23053 | Medium | 6.1 | 2022-02-20 | Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the injection of malicious JavaScript into th… |
CVE-2022-22126 | Medium | 6.1 | 2022-02-20 | Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’… |
CVE-2019-1010060 | Critical | 9.8 | 2019-07-16 | NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed… |
CVE-2018-3847 | High | 8.8 | 2018-08-01 | Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed… |
CVE-2018-3849 | High | 8.8 | 2018-04-16 | In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data… |
CVE-2018-3848 | High | 8.8 | 2018-04-16 | In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data… |
CVE-2018-3846 | High | 8.8 | 2018-04-16 | In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting ar… |
CVE-2018-1000048 | High | 8.8 | 2018-02-09 | NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code… |
CVE-2018-1000047 | High | 8.8 | 2018-02-09 | NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack ap… |
CVE-2018-1000046 | High | 7.8 | 2018-02-09 | NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to… |
CVE-2018-1000045 | High | 7.8 | 2018-02-09 | NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code execution. This attack app… |