Log in Start free

yamcs

Products

ProductCVEsExploitedLatest
yamcs16–Aug 28, 2026

Exploited and recent CVEs

  • CVE-2026-55566 Medium 4.3 Yamcs: DOM XSS in Extension Routing 0.4%
  • CVE-2026-55565 Critical 9.9 Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) 0.7%
  • CVE-2026-55559 Critical 9.8 Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) 0.8%
  • CVE-2026-55552 High 7.5 Yamcs: Unauthenticated Directory Traversal 1.7%
  • CVE-2026-55549 Medium 6.5 Yamcs: Reflected XSS in the URL of the Authorize Endpoint 1.3%
  • CVE-2026-55547 Medium 4.3 Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration 0.3%
  • CVE-2026-55545 Medium 6.5 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce 0.5%
  • CVE-2026-55521 High 8.8 Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API 0.5%
  • CVE-2026-55511 Critical 9.1 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` 0.7%
  • CVE-2026-55548 Medium 4.3 Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets 0.4%
  • CVE-2026-46621 Critical 9.1 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection 1.1%
  • CVE-2026-46562 Critical 9.8 Yamcs: Remote Code Execution via Mission Database algorithm override 1.0%
  • CVE-2026-44632 Critical 9.1 Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` 1.1%
  • CVE-2026-44596 Medium 6.5 Yamcs: No Rate Limiting on Authentication Endpoint 2.1%
  • CVE-2026-44595 Medium 4.3 Yamcs: Unauthorized user enumeration via IAM API endpoints 1.1%
  • CVE-2026-42568 Medium 4.3 Yamcs Vulnerable to LDAP Injection in LdapAuthModule 1.0%