OpenC3 COSMOS any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

8CVEs

OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

Published 2026-05-04 · Analyzed

9.6EPSS 0.005

OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base

Published 2026-05-04 · Analyzed

9.6EPSS 0.004

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

Published 2026-05-04 · Analyzed

8.1EPSS 0.004

OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)

Published 2024-10-02 · Modified

6.5EPSS 0.009

OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)

Published 2024-10-02 · Analyzed

6.5EPSS 0.004

OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)

Published 2024-10-02 · Modified

6.1EPSS 0.005

OpenC3 COSMOS: Self-XSS in the Command Sender

Published 2026-05-04 · Analyzed

4.6EPSS 0.003

OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

Published 2026-05-04 · Analyzed

4.3EPSS 0.004