Openc3 Cosmos
16 CVEs affecting Openc3 Cosmos. Latest disclosed: 2026-05-04. Critical: 7, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68271 | Critical | 10.0 | 2026-01-13 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS con… |
CVE-2025-28389 | Critical | 9.8 | 2025-06-13 | Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. |
CVE-2025-28388 | Critical | 9.8 | 2025-06-13 | OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. |
CVE-2025-28386 | Critical | 9.8 | 2025-06-13 | A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading… |
CVE-2026-42088 | Critical | 9.6 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script… |
CVE-2026-42087 | Critical | 9.6 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7… |
CVE-2025-28384 | Critical | 9.1 | 2025-06-13 | An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
CVE-2026-42084 | High | 8.1 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3… |
CVE-2025-28382 | High | 7.5 | 2025-06-13 | An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
CVE-2025-28381 | High | 7.5 | 2025-06-13 | A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers. |
CVE-2024-47529 | Medium | 6.5 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a… |
CVE-2024-46977 | Medium | 6.5 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside o… |
CVE-2025-28380 | Medium | 6.1 | 2025-06-13 | A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted pay… |
CVE-2024-43795 | Medium | 6.1 | 2024-10-02 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a refl… |
CVE-2026-42086 | Medium | 4.6 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sen… |
CVE-2026-42085 | Medium | 4.3 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3… |