15
CVEs
1
Critical
3
High
0
KEV
3
PoC
3
Unpatched C/H
6.7%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
3
MEDIUM
8
LOW
2
Monthly CVE Trend
Affected Products (21)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2018-25367 | NASA openVSP 3.16.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the geometry name field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.9 | 0.0% | 55 |
PoC
No patch
|
| CVE-2026-15352 | Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist. | HIGH | 8.2 | 0.4% | 51 |
No patch
|
| CVE-2026-18064 | Denial-of-service in the NASA core Flight System (cFS) Health and Safety (HS) application affects versions through 7.0.1, where a NULL pointer dereference left reachable by an incomplete fix for CVE-2026-15352 lets an attacker who can deliver a specific HS command under particular conditions crash the HS application and force a processor reset. The flaw impacts availability only - no confidentiality or integrity loss - and there is no public exploit identified at time of analysis, though it was reported through CISA ICS-CERT (advisory ICSA-26-211-06). Because cFS runs as the flight software framework aboard spacecraft and embedded aerospace systems, a triggered reset can disrupt mission-critical monitoring rather than expose data. | HIGH | 8.2 | 0.3% | 51 |
No patch
|
| CVE-2026-72577 | Remote code execution in NASA fprime-gds through version 3.4.3 lets an unauthenticated remote attacker fully compromise the ground data system and inject arbitrary commands to any connected spacecraft. The Flask ground station exposes every endpoint without authentication (CWE-306), while a path traversal in the upload/download handler permits reading and writing arbitrary files, and a hardcoded Flask secret key (CWE-321) enables session forgery; chained, they yield code execution on the ground station host. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority, real-world risk for anyone running F Prime ground software. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2026-82802 | Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82801 | Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-72579 | OS command injection in NASA HyperCP's OBPGSession.py enables arbitrary code execution on a researcher's workstation when a network-adjacent attacker spoofs or intercepts responses from oceandata.sci.gsfc.nasa.gov. The vulnerable handler passes unsanitized server response header fields directly to subprocess calls, meaning a MitM-positioned attacker can achieve full compromise of the victim machine by injecting shell metacharacters into crafted HTTP response headers during any HyperCP data download operation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-adjacent attack vector combined with complete C/I/A impact makes this a critical threat for research institutions operating on untrusted or shared networks. | HIGH | 7.5 | 0.6% | 38 |
No patch
|
| CVE-2026-82478 | Stack-based buffer overflow in NASA Trick 19.6.0's JSONVariableServer component exposes the simulation framework to remote exploitation via crafted TCP requests, with no patch available and no vendor response to disclosure. The vulnerability resides in JSONVariableServerThread::parse_request, where user-supplied network data is processed through an unbounded sscanf call without bounds checking on a stack-allocated buffer. Unauthenticated remote attackers reaching the TCP socket can trigger this overflow, potentially crashing the simulation process or achieving code execution on the host. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-82479 | Buffer overflow in NASA Core Flight System (cFS) up to version 7.0.1 allows adjacent-network attackers to corrupt memory through the SBN TCP Module's OS_read function. The MsgSz argument read from incoming TCP messages is not bounds-checked before use, enabling a crafted packet to overflow an internal buffer. No vendor patch exists - NASA did not respond to the coordinated disclosure - and no public exploit or KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-82480 | Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-5474 | Heap-based buffer overflow in NASA cFS up to version 7.0.0 exists in the CFE_MSG_GetSize function within the CCSDS Packet Header Handler component (apps/to_lab/fsw/src/to_lab_passthru_encode.c), allowing attackers on the local network to cause memory corruption with limited confidentiality, integrity, and availability impact. The vulnerability requires network adjacency but no authentication or user interaction; no public exploit code has been identified, and the project has not yet released a patch despite early notification through GitHub issue tracking. | MEDIUM | 5.3 | 0.0% | 27 |
No patch
|
| CVE-2026-5475 | Memory corruption in NASA cFS up to version 7.0.0 via manipulation of the CFE_SB_TransmitMsg function in the CCSDS Header Size Handler component allows local attackers with low privileges to corrupt memory, potentially leading to denial of service or information disclosure. No public exploit code or active exploitation has been confirmed; the vendor was notified early but has not yet released a patch as of analysis time. | MEDIUM | 5.1 | 0.0% | 26 |
No patch
|
| CVE-2026-5476 | Integer overflow in NASA cFS CFE_TBL_ValidateCodecLoadSize function (cfe_tbl_passthru_codec.c) on 32-bit systems allows authenticated local attackers with low privileges to cause limited integrity and availability impact, though exploitation requires high attack complexity and no public exploit code has been identified; a fix is planned for an upcoming release milestone. | LOW | 2.1 | 0.0% | 11 |
No patch
|
| CVE-2026-5473 | Unsafe deserialization in NASA cFS Pickle Module (versions up to 7.0.0) allows authenticated local attackers with low privileges to trigger remote code execution or information disclosure through the pickle.load() function. The vulnerability requires high attack complexity and local access, limiting its practical exploitation scope. Public exploit code is available, but the issue remains unpatched as of the last vendor update. | LOW | 1.1 | 0.0% | 6 |
No patch
|
| CVE-2026-41144 | F Prime framework before version 4.2.0 allows remote code execution via integer overflow in bounds checking combined with path traversal in file upload functionality. An attacker sending a crafted DataPacket with byteOffset=0xFFFFFF9C and dataSize=100 causes U32 addition to wrap to zero, bypassing the fileSize validation. This enables writing arbitrary data to any file at any offset on the target system, leading to remote code execution on embedded spaceflight and other critical systems. CISA KEV status and active exploitation unknown; vendor patch available in version 4.2.0. | NONE | – | 0.1% | 0 |
No patch
|