26
CVEs
1
Critical
9
High
0
KEV
13
PoC
6
Unpatched C/H
30.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
9
MEDIUM
12
LOW
3
Monthly CVE Trend
Affected Products (21)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-21898 | CryptoLib versions prior to 1.4.3 contain an out-of-bounds read vulnerability in the Crypto_AOS_ProcessSecurity function that allows remote attackers to crash spacecraft communications systems when parsing malformed AOS frame hashes. Public exploit code exists for this vulnerability affecting cFS deployments that rely on SDLS-EP for spacecraft-to-ground station security. The vulnerability has high severity due to its denial of service impact on critical space communications infrastructure, and no patch is currently available. | HIGH | 8.2 | 0.0% | 61 |
PoC
No patch
|
| CVE-2026-22697 | CryptoLib versions prior to 1.4.3 contain a heap buffer overflow in the KMC crypto service's Base64 decoder, where oversized input strings can write beyond allocated buffer boundaries when processing KMC JSON responses. An attacker with network access to the KMC service can trigger this vulnerability to crash the spacecraft-ground station communication process or potentially execute arbitrary code. Public exploit code exists for this vulnerability, and no patch is currently available. | HIGH | 7.5 | 0.1% | 58 |
PoC
No patch
|
| CVE-2026-22026 | CryptoLib versions prior to 1.4.3 are vulnerable to denial of service through unbounded memory allocation in the KMC crypto service client's HTTP response handling. A malicious or compromised KMC server can trigger excessive memory consumption by sending arbitrarily large responses, causing the client process to crash. Public exploit code exists for this vulnerability affecting spacecraft communications secured by SDLS-EP. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2026-22023 | CryptoLib versions prior to 1.4.3 contain an out-of-bounds heap read in the cryptography_aead_encrypt() function, affecting spacecraft communications secured via the SDLS-EP protocol. Public exploit code exists for this vulnerability, allowing remote attackers to trigger a denial of service condition without authentication. The vulnerability impacts systems using CryptoLib for ground-to-spacecraft communications and has been patched in version 1.4.3. | HIGH | 7.5 | 0.0% | 58 |
PoC
|
| CVE-2025-59534 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available. | HIGH | 7.3 | 0.0% | 57 |
PoC
|
| CVE-2018-25367 | NASA openVSP 3.16.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the geometry name field. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.9 | 0.0% | 55 |
PoC
No patch
|
| CVE-2026-15352 | Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist. | HIGH | 8.2 | 0.4% | 51 |
No patch
|
| CVE-2026-18064 | Denial-of-service in the NASA core Flight System (cFS) Health and Safety (HS) application affects versions through 7.0.1, where a NULL pointer dereference left reachable by an incomplete fix for CVE-2026-15352 lets an attacker who can deliver a specific HS command under particular conditions crash the HS application and force a processor reset. The flaw impacts availability only - no confidentiality or integrity loss - and there is no public exploit identified at time of analysis, though it was reported through CISA ICS-CERT (advisory ICSA-26-211-06). Because cFS runs as the flight software framework aboard spacecraft and embedded aerospace systems, a triggered reset can disrupt mission-critical monitoring rather than expose data. | HIGH | 8.2 | 0.3% | 51 |
No patch
|
| CVE-2026-22027 | Heap buffer overflow in CryptoLib versions prior to 1.4.3 allows a high-privileged local attacker to corrupt adjacent memory by supplying oversized hex strings in MariaDB SA fields without capacity validation. Public exploit code exists for this vulnerability affecting spacecraft communication security implementations. The flaw enables denial of service and potential code execution through heap memory manipulation. | MEDIUM | 6.0 | 0.0% | 50 |
PoC
|
| CVE-2026-72577 | Remote code execution in NASA fprime-gds through version 3.4.3 lets an unauthenticated remote attacker fully compromise the ground data system and inject arbitrary commands to any connected spacecraft. The Flask ground station exposes every endpoint without authentication (CWE-306), while a path traversal in the upload/download handler permits reading and writing arbitrary files, and a hardcoded Flask secret key (CWE-321) enables session forgery; chained, they yield code execution on the ground station host. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority, real-world risk for anyone running F Prime ground software. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2026-21900 | CryptoLib versions prior to 1.4.3 suffer from an out-of-bounds heap read in the cryptography_encrypt() function when processing malformed JSON metadata from KMC servers, allowing remote attackers to trigger a denial of service condition. The vulnerability stems from improper buffer boundary checking during string parsing in spacecraft-ground station communications secured by the SDLS-EP protocol. Public exploit code exists for this medium-severity flaw, though a patch is available. | MEDIUM | 5.9 | 0.1% | 50 |
PoC
|
| CVE-2026-82802 | Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82801 | Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-22024 | CryptoLib versions prior to 1.4.3 leak approximately 400 bytes of memory with each call to the cryptography_encrypt() function due to unfreed buffers, allowing remote attackers to conduct denial-of-service attacks against spacecraft-to-ground communications by exhausting available memory through sustained traffic. Public exploit code exists for this vulnerability. The issue is resolved in version 1.4.3 and later. | MEDIUM | 5.3 | 0.0% | 47 |
PoC
|
| CVE-2026-21899 | CryptoLib versions prior to 1.4.3 contain an out-of-bounds read vulnerability in the base64urlDecode function that dereferences memory before validating input parameters, potentially causing a denial of service in spacecraft communications secured by SDLS-EP. Affected systems running cFS with vulnerable CryptoLib versions could crash when processing malformed base64 input. Public exploit code exists for this vulnerability, though no patch is currently available. | MEDIUM | 4.7 | 0.0% | 44 |
PoC
No patch
|