Skip to content
Noroxi

OpenC3 records

15 published records for vendor openc3.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
53.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 24
  2. 25
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

15 records
  • CVE-2025-28386
    39Monitor

    A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary

    CriticalCVSS 9.8No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2025-28388
    39Monitor

    OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

    CriticalCVSS 9.8No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2025-28389
    39Monitor

    Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

    CriticalCVSS 9.8No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2026-42087
    38Monitor

    OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

    CriticalCVSS 9.6No exploitEPSS 0%

    openc3 · cosmosMay 4, 2026

  • CVE-2025-28384
    36Monitor

    An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

    CriticalCVSS 9.1No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2026-42088
    32Monitor

    OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

    HighCVSS 8.1No exploitEPSS 0%

    openc3 · cosmosMay 4, 2026

  • CVE-2026-42084
    32Monitor

    OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

    HighCVSS 8.1No exploitEPSS 0%

    openc3 · cosmosMay 4, 2026

  • CVE-2025-28382
    30Monitor

    An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

    HighCVSS 7.5No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2025-28381
    30Monitor

    A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all conta

    HighCVSS 7.5No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2025-28380
    24Monitor

    A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via inje

    MediumCVSS 6.1No exploitEPSS 0%

    openc3 · cosmosJun 13, 2025

  • CVE-2024-46977
    21Monitor

    OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

    MediumCVSS 5.3No exploitEPSS 1%

    openc3 · cosmosOct 2, 2024

  • CVE-2024-43795
    20Monitor

    OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)

    MediumCVSS 5.1No exploitEPSS 0%

    openc3 · cosmosOct 2, 2024

  • CVE-2024-47529
    19Monitor

    OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

    MediumCVSS 4.8No exploitEPSS 0%

    openc3 · cosmosOct 2, 2024

  • CVE-2026-42086
    18Monitor

    OpenC3 COSMOS: Self-XSS in the Command Sender

    MediumCVSS 4.6No exploitEPSS 0%

    openc3 · cosmosMay 4, 2026

  • CVE-2026-42085
    17Monitor

    OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

    MediumCVSS 4.3No exploitEPSS 0%

    openc3 · cosmosMay 4, 2026