OpenC3 vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20269

Newest CVEs

• CVE-2026-77602

  OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

  OpenC3 · cosmos

  Critical9.9
• CVE-2026-77394

  OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

  OpenC3 · cosmos

  High7.6
• CVE-2026-77601

  OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

  OpenC3 · cosmos

  High8.8
• CVE-2026-42088

  OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

  OpenC3 · cosmos

  Critical9.6
• CVE-2026-42087

  OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

  OpenC3 · cosmos

  Critical9.6
• CVE-2026-42086

  OpenC3 COSMOS: Self-XSS in the Command Sender

  OpenC3 · cosmos

  Medium4.6
• CVE-2026-42085

  OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

  OpenC3 · cosmos

  Medium4.3
• CVE-2026-42084

  OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

  OpenC3 · cosmos

  High8.1
• CVE-2025-68271

  Unauthenticated Remote Code Execution in openc3-api

  OpenC3 · cosmos

  Critical10.0
• CVE-2024-47529

  OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

  OpenC3 · cosmos

  Medium4.8