| OpenC3 COSMOS: Hijacked session token can be used to reset password for persistenceCVE-2026-42084 · GHSA-WGX6-G857-JJF7 |
openc3openc3 |
PyPIRubyGems |
High
|
Fix reported |
|
| OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenamesCVE-2026-42085 · GHSA-4JVX-93H3-F45H |
openc3openc3 |
PyPIRubyGems |
Medium
|
Fix reported |
|
| OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner ToolCVE-2026-42088 · GHSA-2WVH-87G2-89HR |
openc3openc3 |
PyPIRubyGems |
Critical
|
Fix reported |
|
| OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpointCVE-2025-28384 · GHSA-P67J-387G-75WC |
openc3openc3-cosmos-tool-iframe |
PyPIRubyGems |
Critical
|
No fix reported |
|
| OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpointCVE-2025-28382 · GHSA-CF8V-5MRC-JV7F |
openc3openc3-cosmos-tool-iframe |
PyPIRubyGems |
High
|
No fix reported |
|
| OpenC3 COSMOS has SQL Injection in QuestDB Time-Series DatabaseCVE-2026-42087 · GHSA-V529-VHWC-WFC5 |
openc3openc3 |
PyPIRubyGems |
Critical
|
Fix reported |
|
| PYSEC-2025-254CVE-2025-28380 · PYSEC-2025-254 |
openc3 |
PyPI |
Medium
|
No fix reported |
|
| PYSEC-2025-255CVE-2025-28381 · PYSEC-2025-255 |
openc3 |
PyPI |
High
|
No fix reported |
|
| PYSEC-2025-258CVE-2025-28388 · PYSEC-2025-258 |
openc3 |
PyPI |
Critical
|
No fix reported |
|
| OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command SenderCVE-2026-42086 · GHSA-FFQ5-QPVF-XQ7XVersion ranges need review. |
openc3openc3 |
PyPIRubyGems |
Medium
|
Fix reported |
|
| PYSEC-2025-150CVE-2025-28389 · PYSEC-2025-150 |
openc3 |
PyPI |
Critical
|
No fix reported |
|
| PYSEC-2025-149CVE-2025-28386 · PYSEC-2025-149 |
openc3 |
PyPI |
Critical
|
No fix reported |
|
| OpenC3 stores passwords in clear text (`GHSL-2024-129`)CVE-2024-47529 · GHSA-4XQV-47RM-37MMVersion ranges need review. |
@openc3/tool-commonopenc3 |
npmPyPIRubyGems |
Medium
|
Fix reported |
|
| OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)CVE-2024-43795 · GHSA-VFJ8-5PJ7-2F9GVersion ranges need review. |
@openc3/tool-commonopenc3 |
npmPyPIRubyGems |
Medium
|
Fix reported |
|
| OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)CVE-2024-46977 · GHSA-8JXR-MCCC-MWG8Version ranges need review. |
openc3openc3 |
PyPIRubyGems |
High
|
Fix reported |
|
