OOpenC3

Products

Exploited and recent CVEs

• CVE-2026-77602 Critical 9.9 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) 0.7%
• CVE-2026-77394 High 7.6 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget 0.4%
• CVE-2026-77601 High 8.8 OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting 0.6%
• CVE-2026-42088 Critical 9.6 OpenC3 COSMOS: Administrative Actions via the Script Runner Tool 0.3%
• CVE-2026-42087 Critical 9.6 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base 0.3%
• CVE-2026-42086 Medium 4.6 OpenC3 COSMOS: Self-XSS in the Command Sender 0.2%
• CVE-2026-42085 Medium 4.3 OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames 0.3%
• CVE-2026-42084 High 8.1 OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence 0.3%
• CVE-2025-68271 Critical 10.0 Unauthenticated Remote Code Execution in openc3-api 0.6%
• CVE-2024-47529 Medium 4.8 OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`) 0.4%
• CVE-2024-46977 Medium 5.3 OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`) 0.9%
• CVE-2024-43795 Medium 5.1 OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`) 0.5%