OSC vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 20262

Newest CVEs

• CVE-2026-44371

  Open OnDemand: Specially crafted filenames can execute javascript in the file browser

  OSC · ondemand

  Medium5.3
• CVE-2026-26002

  OnDemand susceptible to malicious input when navigating to a directory.

  OSC · ondemand

  Medium6.3
• CVE-2025-66029

  Open OnDemand affected by Apache proxy passing sensitive headers

  OSC · ondemand

  High7.6
• CVE-2025-64185

  Open OnDemand RPM packages create world writable locations

  OSC · ondemand

  Medium6.9
• CVE-2025-62724

  Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)

  OSC · ondemand

  Medium4.3
• CVE-2025-58435

  Open OnDemand didn't rotate password for VNC batch_connect

  OSC · ondemand

  Medium4.1
• CVE-2025-53636

  Open OnDemand Shell App closed websocket DoS

  OSC · ondemand

  Medium5.4