Nasa vulnerabilities, page 5

87 vulnerabilities

Known vulnerabilities in Nasa products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 19 products.

7.5CVE-2026-82801nasaearthdata-search
EPSS score
0.47%
A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.7.5CVE-2026-82478nasatrick
EPSS score
0.54%
A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableServerThread::parse_request of the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp of the component TCP Socket Handler. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.9.8CVE-2026-60113nasa-ammosait-dsn+1
EPSS score
0.83%
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.9.8CVE-2026-60112nasa-ammosait-gui+1
EPSS score
0.79%
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.7.5CVE-2023-45282nasaopenmct+1
EPSS score
1.16%
In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.5.4CVE-2023-45885nasaopenmct+1
EPSS score
0.46%
Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.6.5CVE-2023-45884nasaopenmct+1
EPSS score
0.33%
Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.