5
CVEs
0
Critical
0
High
0
KEV
2
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (21)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82802 | Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82801 | Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82478 | Stack-based buffer overflow in NASA Trick 19.6.0's JSONVariableServer component exposes the simulation framework to remote exploitation via crafted TCP requests, with no patch available and no vendor response to disclosure. The vulnerability resides in JSONVariableServerThread::parse_request, where user-supplied network data is processed through an unbounded sscanf call without bounds checking on a stack-allocated buffer. Unauthenticated remote attackers reaching the TCP socket can trigger this overflow, potentially crashing the simulation process or achieving code execution on the host. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-82479 | Buffer overflow in NASA Core Flight System (cFS) up to version 7.0.1 allows adjacent-network attackers to corrupt memory through the SBN TCP Module's OS_read function. The MsgSz argument read from incoming TCP messages is not bounds-checked before use, enabling a crafted packet to overflow an internal buffer. No vendor patch exists - NASA did not respond to the coordinated disclosure - and no public exploit or KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-82480 | Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|