PT-2026-2491

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.0.0 through 6.10.1 Description OpenC3 COSMOS provides functionality to send commands to and receive data from embedded systems. Versions 5.0.0 through 6.10.1 contain a remote code execution issue reachable through the...

EUVD-2024-0128

Malicious code in bioql PyPI...

EUVD-2025-18281

Malicious code in bioql PyPI...

EUVD-2025-18282

Malicious code in bioql PyPI...

EUVD-2024-0126

Malicious code in bioql PyPI...

EUVD-2025-18269

Malicious code in bioql PyPI...

EUVD-2025-18270

Malicious code in bioql PyPI...

EUVD-2024-0127

Malicious code in bioql PyPI...

EUVD-2025-18283

Malicious code in bioql PyPI...

EUVD-2025-18268

Malicious code in bioql PyPI...

Directory Traversal

openc3-cosmos-tool-iframe is vulnerable to Directory Traversal. The vulnerability is due to improper input validation and insufficient sanitization of path parameters in the /script-api/scripts/ endpoint, allowing attackers to access unauthorized directories...

CVE-2025-28386

A remote code execution RCE vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file...

CVE-2025-28382

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2025-28384

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

GHSA-P67J-387G-75WC OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal...

OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal...