What’s Vulnerable › Products
yamcs vulnerabilities
21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your yamcs version is affected
Latest yamcs vulnerabilities
- CVE-2026-55566 — Yamcs: DOM XSS in Extension Routing (CVSS 4.3)
- CVE-2026-55565 — Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) (CVSS 9.9)
- CVE-2026-55559 — Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) (CVSS 9.8)
- CVE-2026-55552 — Yamcs: Unauthenticated Directory Traversal (CVSS 7.5)
- CVE-2026-55549 — Yamcs: Reflected XSS in the URL of the Authorize Endpoint (CVSS 6.5)
- CVE-2026-55547 — Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration (CVSS 4.3)
- CVE-2026-55545 — Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce (CVSS 6.5)
- CVE-2026-55521 — Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API (CVSS 8.8)
- CVE-2026-55511 — Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` (CVSS 9.1)
- CVE-2026-55548 — Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets (CVSS 4.3)
- CVE-2026-46621 — Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection (CVSS 9.1)
- CVE-2026-46562 — Yamcs: Remote Code Execution via Mission Database algorithm override (CVSS 9.8)
- CVE-2026-44632 — Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` (CVSS 9.1)
- CVE-2026-44596 — Yamcs: No Rate Limiting on Authentication Endpoint (CVSS 9.8)
- CVE-2026-44595 — Yamcs: Unauthorized user enumeration via IAM API endpoints (CVSS 4.3)
- CVE-2026-42568 — Yamcs Vulnerable to LDAP Injection in LdapAuthModule (CVSS 4.3)
- CVE-2023-45280 — (CVSS 5.4)
- CVE-2023-45279 — (CVSS 5.4)
- CVE-2023-45281 — (CVSS 6.1)
- CVE-2023-45278 — (CVSS 9.1)
- CVE-2023-45277 — (CVSS 7.5)