MAL-2026-15829 Malicious code in telemetry-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname,...

Malicious Package

Overview telemetry-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55545

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges ReadPacket when an API request omits specific packet names. As a result, an attacker with a low-privileged account or any authenticated user with zero privileges can dump the entire archive of...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the exportPackets process. An attacker can access sensitive telemetry data by sending an API request without specifying any packet names, which bypasses intended privilege checks and streams all available...

EUVD-2026-44960

Yamcs: Insecure Direct Object Reference IDOR in PacketsApi allows unprivileged users to dump all telemetry packets...

CVE-2026-55545

CVE-2026-55545 is an authorization bypass in Yamcs , a mission control framework, affecting versions prior to 5.12.8 and 5.13.2 . Three WebSocket subscription handlers fail to enforce the privilege checks their REST counterparts require: PacketsApi.subscribePackets omits the ReadPacket check, Pro...

CVE-2026-55545 Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the API controllers responsible for handling IndexesApi, Cop1Api, and TimeApi operations. An attacker can extract sensitive telemetry metadata, disrupt satellite communication link protocols, and manipulate the...

CVE-2026-55521

Yamcs , a mission control framework, contains multiple missing function-level access control vulnerabilities in its Core API. Prior to 5.12.8 and 5.13.2 , authorization checks are omitted in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable/resume/initialize/updateConfig, and...

CVE-2026-55521 Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55521

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55511

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55521: Missing Authorization

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-55511: Improper Control of Generation of Code

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-37012

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials...

CVE-2026-81664

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-81664 OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...

CVE-2026-81664

The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basicauth is enabled, wraps each administrative /system/ handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced the route, until 0.27.14, which added i...