yamcs vulnerabilities

Newest CVEs

• CVE-2026-55566

  Yamcs: DOM XSS in Extension Routing

  yamcs · yamcs

  Medium4.3
• CVE-2026-55565

  Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

  yamcs · yamcs

  Critical9.9
• CVE-2026-55559

  Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)

  yamcs · yamcs

  Critical9.8
• CVE-2026-55552

  Yamcs: Unauthenticated Directory Traversal

  yamcs · yamcs

  High7.5
• CVE-2026-55549

  Yamcs: Reflected XSS in the URL of the Authorize Endpoint

  yamcs · yamcs

  Medium6.5
• CVE-2026-55547

  Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

  yamcs · yamcs

  Medium4.3
• CVE-2026-55545

  Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

  yamcs · yamcs

  Medium6.5
• CVE-2026-55521

  Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

  yamcs · yamcs

  High8.8
• CVE-2026-55511

  Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

  yamcs · yamcs

  Critical9.1
• CVE-2026-55548

  Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

  yamcs · yamcs

  Medium4.3