9
CVEs
1
Critical
3
High
0
KEV
2
PoC
3
Unpatched C/H
11.1%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
3
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (21)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15352 | Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist. | HIGH | 8.2 | 0.4% | 51 |
No patch
|
| CVE-2026-18064 | Denial-of-service in the NASA core Flight System (cFS) Health and Safety (HS) application affects versions through 7.0.1, where a NULL pointer dereference left reachable by an incomplete fix for CVE-2026-15352 lets an attacker who can deliver a specific HS command under particular conditions crash the HS application and force a processor reset. The flaw impacts availability only - no confidentiality or integrity loss - and there is no public exploit identified at time of analysis, though it was reported through CISA ICS-CERT (advisory ICSA-26-211-06). Because cFS runs as the flight software framework aboard spacecraft and embedded aerospace systems, a triggered reset can disrupt mission-critical monitoring rather than expose data. | HIGH | 8.2 | 0.3% | 51 |
No patch
|
| CVE-2026-72577 | Remote code execution in NASA fprime-gds through version 3.4.3 lets an unauthenticated remote attacker fully compromise the ground data system and inject arbitrary commands to any connected spacecraft. The Flask ground station exposes every endpoint without authentication (CWE-306), while a path traversal in the upload/download handler permits reading and writing arbitrary files, and a hardcoded Flask secret key (CWE-321) enables session forgery; chained, they yield code execution on the ground station host. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority, real-world risk for anyone running F Prime ground software. | CRITICAL | 9.8 | 0.9% | 50 |
|
| CVE-2026-82802 | Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82801 | Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-72579 | OS command injection in NASA HyperCP's OBPGSession.py enables arbitrary code execution on a researcher's workstation when a network-adjacent attacker spoofs or intercepts responses from oceandata.sci.gsfc.nasa.gov. The vulnerable handler passes unsanitized server response header fields directly to subprocess calls, meaning a MitM-positioned attacker can achieve full compromise of the victim machine by injecting shell metacharacters into crafted HTTP response headers during any HyperCP data download operation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-adjacent attack vector combined with complete C/I/A impact makes this a critical threat for research institutions operating on untrusted or shared networks. | HIGH | 7.5 | 0.6% | 38 |
No patch
|
| CVE-2026-82478 | Stack-based buffer overflow in NASA Trick 19.6.0's JSONVariableServer component exposes the simulation framework to remote exploitation via crafted TCP requests, with no patch available and no vendor response to disclosure. The vulnerability resides in JSONVariableServerThread::parse_request, where user-supplied network data is processed through an unbounded sscanf call without bounds checking on a stack-allocated buffer. Unauthenticated remote attackers reaching the TCP socket can trigger this overflow, potentially crashing the simulation process or achieving code execution on the host. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-82479 | Buffer overflow in NASA Core Flight System (cFS) up to version 7.0.1 allows adjacent-network attackers to corrupt memory through the SBN TCP Module's OS_read function. The MsgSz argument read from incoming TCP messages is not bounds-checked before use, enabling a crafted packet to overflow an internal buffer. No vendor patch exists - NASA did not respond to the coordinated disclosure - and no public exploit or KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.3% | 27 |
No patch
|
| CVE-2026-82480 | Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|