Product by Openc3

    Cosmos

    19 known vulnerabilities in Cosmos (Openc3), 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Cosmos (Openc3)
    CriticalCVE-2026-77602

    OpenC3 Cosmos: Code Injection

    		9.9
    HighCVE-2026-77601

    OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

    		8.8
    CriticalCVE-2025-28386

    Openc3 Cosmos: Remote Code Execution

    		9.8
    CriticalCVE-2025-68271

    Unauthenticated Remote Code Execution in openc3-api

    		10.0
    CriticalCVE-2025-28384

    Openc3 Cosmos: Path Traversal

    		9.1
    CriticalCVE-2025-28388

    Openc3 Cosmos: Hard-coded Credentials

    		9.8
    CriticalCVE-2025-28389

    Openc3 Cosmos: Authentication Bypass

    		9.8
    HighCVE-2026-77394

    OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

    		7.6
    HighCVE-2025-28382

    Openc3 Cosmos: Path Traversal

    		7.5
    CriticalCVE-2026-42087

    OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

    		9.6
    MediumCVE-2024-46977

    OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

    		6.5
    CriticalCVE-2026-42088

    OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

    		8.1
    HighCVE-2025-28381

    Openc3 Cosmos: security vulnerability

    		7.5
    HighCVE-2026-42084

    OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

    		8.1
    MediumCVE-2024-43795

    OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)

    		6.1
    MediumCVE-2025-28380

    Openc3 Cosmos: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2024-47529

    OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

    		6.5
    MediumCVE-2026-42085

    OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

    		4.3
    MediumCVE-2026-42086

    OpenC3 COSMOS: Self-XSS in the Command Sender

    		4.6

    News

    All products by Openc3