Spaceapplications Yamcs
11 CVEs affecting Spaceapplications Yamcs. Latest disclosed: 2026-07-16. Critical: 4, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46562 | Critical | 9.8 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main… |
CVE-2026-46621 | Critical | 9.1 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-control… |
CVE-2026-44632 | Critical | 9.1 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.al… |
CVE-2023-45278 | Critical | 9.1 | 2023-10-19 | Directory Traversal vulnerability in the storage functionality of the API in Yamcs 5.8.6 allows attackers to delete arbitrary files via crafted HTTP DELETE req… |
CVE-2023-45277 | High | 7.5 | 2023-10-19 | Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base… |
CVE-2026-44596 | Medium | 6.5 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamc… |
CVE-2023-45281 | Medium | 6.1 | 2023-10-19 | An issue in Yamcs 5.8.6 allows attackers to obtain the session cookie via upload of crafted HTML file. |
CVE-2023-45280 | Medium | 5.4 | 2023-10-19 | Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to uplo… |
CVE-2023-45279 | Medium | 5.4 | 2023-10-19 | Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to uplo… |
CVE-2026-55548 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsA… |
CVE-2026-44595 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the req… |