MavenPackage

org.yamcs:yamcs-core

16 known vulnerabilities (6 critical, 2 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release: 5.14.0 (Oct 31, 2026): no advisory affects it
Newest unaffected release: 5.14.0 (Oct 31, 2026), the latest release
Advisories: 16 · 6 critical, 2 high, 8 medium

Dependents: 9
Releases: 176 since 0.29.3 (Mar 13, 2016)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-55566
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55565
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55559
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55552
Affects 0.29.3 to 5.11.13 (5.12.0 is outside it)
CVE-2026-55549
Affects 0.29.3 to 5.9.3 (5.9.4 is outside it)
CVE-2026-55547
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55545
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55521
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55511
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-55548
Affects 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it)
CVE-2026-46621
Affects 0.29.3 to 5.12.6 (5.12.7 is outside it)
CVE-2026-46562
Affects 0.29.3 to 5.12.6 (5.12.7 is outside it)

Show all 16 advisoriesShow fewer advisories

CVE-2026-44632
Affects 0.29.3 to 5.12.6 (5.12.7 is outside it)
CVE-2026-44596
Affects 0.29.3 to 5.12.6 (5.12.7 is outside it)
CVE-2026-44595
Affects 0.29.3 to 5.12.6 (5.12.7 is outside it)
CVE-2026-42568
Affects 0.29.3 to 5.12.6 (5.12.7 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

CVE-2026-55566Medium 4.3
Yamcs: DOM XSS in Extension Routing
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55565Critical 9.9
Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55559Critical 9.8
Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55552High 7.5
Yamcs: Unauthenticated Directory Traversal
Affected: fixed in 5.12.0.
Fixed in 5.12.0 (released Jul 16, 2025, 408 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55549Medium 6.5
Yamcs: Reflected XSS in the URL of the Authorize Endpoint
Affected: fixed in 5.9.4.
Fixed in 5.9.4 (released Apr 11, 2024, 869 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55547Medium 4.3
Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security…
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55545Medium 6.5
Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce
Affected: fixed in 5.12.8; from 5.13.0, fixed in 5.13.2.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55521High 8.8
Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55511Critical 9.1
Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-55548Medium 4.3
Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8.
Fixed in 5.12.8 (released Jul 14, 2026, 2 days before disclosure) and 5.13.2 (released Jul 14, 2026, 2 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-46621Critical 9.1
Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
Affected: fixed in 5.12.7.
Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-46562Critical 9.8
Yamcs: Remote Code Execution via Mission Database algorithm override
Affected: fixed in 5.12.7.
Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-44632Critical 9.1
Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
Affected: fixed in 5.12.7.
Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-44596Medium 6.5
Yamcs: No Rate Limiting on Authentication Endpoint
Affected: fixed in 5.12.7.
Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-44595Medium 4.3
Yamcs: Unauthorized user enumeration via IAM API endpoints
Affected: fixed in 5.12.7.
Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure).
The latest release, 5.14.0, is not affected.
CVE-2026-42568Medium 4.3
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
Affected: fixed in 5.12.7.
Fixed in 5.12.7 (released May 21, 2026, 20 days before disclosure).
The latest release, 5.14.0, is not affected.