Openc3
Openc3 Cosmos: vulnerabilidades y CVE
Openc3 Cosmos tiene 22 vulnerabilidades publicadas, 11 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE22
Últimos 12 meses11
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-77602 | Crítica (9.9) | 0.57% | — | 23 sept 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under… |
| CVE-2026-77601 | Alta (8.8) | 0.58% | — | 23 sept 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting… |
| CVE-2026-77394 | Alta (7.6) | 0.39% | — | 23 sept 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen… |
| CVE-2026-49446 | Media (6.1) | 0.30% | — | 15 sept 2026 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through… |
| CVE-2026-49447 | Media (5.3) | 0.38% | — | 28 jul 2026 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses… |
| CVE-2026-42088 | Alta (8.1) | 0.49% | — | 4 may 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby… |
| CVE-2026-42087 | Crítica (9.6) | 0.45% | — | 4 may 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the… |
| CVE-2026-42086 | Media (4.6) | 0.29% | — | 4 may 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command… |
| CVE-2026-42085 | Media (4.3) | 0.41% | — | 4 may 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the… |
| CVE-2026-42084 | Alta (8.1) | 0.44% | — | 4 may 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to… |
| CVE-2025-68271 | Crítica (10) | 0.63% | — | 13 ene 2026 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS contains a critical remote code execution vulnerability… |
| CVE-2025-28389 | Crítica (9.8) | 0.60% | — | 13 jun 2025 | Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. |
| CVE-2025-28388 | Crítica (9.8) | 0.61% | — | 13 jun 2025 | OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. |
| CVE-2025-28386 | Crítica (9.8) | 1.1% | — | 13 jun 2025 | A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file. |
| CVE-2025-28384 | Crítica (9.1) | 0.89% | — | 13 jun 2025 | An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
| CVE-2025-28382 | Alta (7.5) | 0.89% | — | 13 jun 2025 | An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
| CVE-2025-28381 | Alta (7.5) | 0.52% | — | 13 jun 2025 | A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers. |
| CVE-2025-28380 | Media (6.1) | 0.34% | — | 13 jun 2025 | A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. |
| CVE-2025-23214 | Media (6.9) | 0.63% | — | 20 ene 2025 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out… |
| CVE-2024-47529 | Media (4.8) | 0.35% | — | 2 oct 2024 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This… |
| CVE-2024-46977 | Media (5.3) | 0.91% | — | 2 oct 2024 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's open_local_file method allows an authenticated… |
| CVE-2024-43795 | Media (5.1) | 0.48% | — | 2 oct 2024 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting (XSS) vulnerability. This… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.