CVE-2026-67978

An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via transmitting a crafted SBN frame...

CVE-2026-67978: Improper Input Validation

An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via transmitting a crafted SBN frame...

CVE-2026-18064

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

MAL-2026-11316 Malicious code in hjw-nasa-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b1632ded6ca00645c902a9d691d08823c53920ffd804e142b535efbca479664 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview hjw-nasa-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in hjw-nasa-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b1632ded6ca00645c902a9d691d08823c53920ffd804e142b535efbca479664 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in hjw-nasa-lib

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-18064

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-18064: NULL Pointer Dereference

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-47731

Summary (validated by connected docs): CVE-2026-47731 affects the NASA AMMOS AIT-Core software’s Binary Stream Capture (BSC) component. An unauthenticated HTTP API under /NAME/start allows a remote attacker to trigger path traversal by supplying attacker-controlled fields (log_dir_path, path, fil...

CVE-2026-15352

A vulnerability exists in the Health & Safety HS application of NASA's Core Flight System cFS. The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service...

CVE-2026-15352 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

A vulnerability exists in the Health & Safety HS application of NASA's Core Flight System cFS. The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service...

CVE-2026-15352: NULL Pointer Dereference

A vulnerability exists in the Health & Safety HS application of NASA's Core Flight System cFS. The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service...

NASA AIT-Core uses unencrypted channels to exchange data over the network

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack...

PYSEC-2026-1113 NASA AIT-Core uses unencrypted channels to exchange data over the network

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack...

PYSEC-2026-261 NASA AIT-Core vulnerable to remote code execution

An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string...

PYSEC-2026-264 NASA AIT-Core vulnerable to remote code execution

An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands...

PYSEC-2026-262 NASA AIT-Core vulnerable to SQL Injection

NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the querypackets and insert functions...

GHSA-P462-PRXW-MJX4 NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

Summary The Binary Stream Capture BSC component exposes an unauthenticated HTTP API for dynamically creating packet capture “handlers.” Because the code blindly trusts path‑related form fields, a remote client can: - Bypass the configured log root and direct BSC to log to arbitrary filesystem...

CVE-2018-25367: Buffer Copy without Checking Size of Input

NASA openVSP 3.16.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the geometry name field. Attackers can trigger a denial of service by pasting a 5000-byte payload into the name input field within the Geom...