Yamcs vulnerabilities

Products

• Yamcs 16

Newest

• yamcs Yamcs: DOM XSS in Extension Routing CVE-2026-55566 Fix available 4.3 MediumAugust 28, 2026
• yamcs Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) CVE-2026-55565 Fix available 9.9 CriticalAugust 28, 2026
• yamcs Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) CVE-2026-55559 Fix available 9.8 CriticalAugust 28, 2026
• yamcs Yamcs: Unauthenticated Directory Traversal CVE-2026-55552 Fix available 7.5 HighAugust 28, 2026
• yamcs Yamcs: Reflected XSS in the URL of the Authorize Endpoint CVE-2026-55549 Fix available 6.5 MediumAugust 28, 2026
• yamcs Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration CVE-2026-55547 Fix available 4.3 MediumAugust 28, 2026
• yamcs Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce CVE-2026-55545 Fix available 6.5 MediumAugust 28, 2026
• yamcs Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API CVE-2026-55521 Fix available 8.8 HighAugust 28, 2026
• yamcs Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` CVE-2026-55511 Public exploitFix available 9.1 CriticalAugust 28, 2026
• spaceapplications yamcs Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets CVE-2026-55548 Fix available 4.3 MediumJuly 16, 2026
• spaceapplications yamcs Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection CVE-2026-46621 Fix available 9.1 CriticalMay 27, 2026
• spaceapplications yamcs Yamcs: Remote Code Execution via Mission Database algorithm override CVE-2026-46562 Fix available 9.8 CriticalMay 27, 2026
• spaceapplications yamcs Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` CVE-2026-44632 Fix available 9.1 CriticalMay 27, 2026
• spaceapplications yamcs Yamcs: No Rate Limiting on Authentication Endpoint CVE-2026-44596 Public exploitFix available 6.5 MediumMay 27, 2026
• spaceapplications yamcs Yamcs: Unauthorized user enumeration via IAM API endpoints CVE-2026-44595 Public exploitFix available 4.3 MediumMay 27, 2026
• yamcs Yamcs Vulnerable to LDAP Injection in LdapAuthModule CVE-2026-42568 Public exploitFix available 4.3 MediumMay 26, 2026