yamcs has 9 CVEs on record. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 9. The median CVSS is 7.5 (high), with 3 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (3) and CWE-94 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Weakness classes
Products
- org.yamcs:yamcs-core 9
Worst active — by depth score
CVE-2026-55511Critical· 9.1Yamcs is a mission control framework62CVE-2026-55565Critical· 9.9Yamcs is a mission control framework55CVE-2026-55559Critical· 9.8Yamcs is a mission control framework54CVE-2026-55549Medium· 6.5Yamcs is a mission control framework48CVE-2026-55521High· 8.8Yamcs is a mission control framework48
yamcs vulnerabilities
CVEs affecting yamcs, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-55559Critical· 9.8Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templat…
CVE-2026-55565Critical· 9.9Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source c…
CVE-2026-55566Medium· 4.3Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component…
CVE-2026-55511Critical· 9.1PoCYamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fil…
CVE-2026-55521High· 8.8Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and T…
CVE-2026-55545Medium· 6.5Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic…
CVE-2026-55547Medium· 4.3Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.jav…
CVE-2026-55549Medium· 6.5PoCYamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping b…
CVE-2026-55552High· 7.5Yamcs is a mission control framework
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the…