# org.yamcs:yamcs-core (Maven) vulnerabilities 16 known vulnerabilities (6 critical, 2 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.14.0 (Oct 31, 2026): no advisory affects it - Newest unaffected release: 5.14.0 (Oct 31, 2026), the latest release - Dependents: 9 - Releases: 176 since 0.29.3 (Mar 13, 2016) - Registry: https://central.sonatype.com/artifact/org.yamcs/yamcs-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55566: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55565: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55559: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55552: 0.29.3 to 5.11.13 (5.12.0 is outside it) - CVE-2026-55549: 0.29.3 to 5.9.3 (5.9.4 is outside it) - CVE-2026-55547: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55545: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55521: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55511: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-55548: 0.29.3 to 5.12.7 (5.12.8 is outside it); 5.13.0 to 5.13.1 (5.13.2 is outside it) - CVE-2026-46621: 0.29.3 to 5.12.6 (5.12.7 is outside it) - CVE-2026-46562: 0.29.3 to 5.12.6 (5.12.7 is outside it) - CVE-2026-44632: 0.29.3 to 5.12.6 (5.12.7 is outside it) - CVE-2026-44596: 0.29.3 to 5.12.6 (5.12.7 is outside it) - CVE-2026-44595: 0.29.3 to 5.12.6 (5.12.7 is outside it) - CVE-2026-42568: 0.29.3 to 5.12.6 (5.12.7 is outside it) ## Advisories (16) ### [CVE-2026-55566](https://cve.now/CVE-2026-55566): Yamcs: DOM XSS in Extension Routing - Severity: Medium 4.3 - Published: Aug 28, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55565](https://cve.now/CVE-2026-55565): Yamcs: Authenticated remote code execution via unescaped StreamSQL \`LIKE\` pattern compiled by Janino (\`LikeExpression\`) - Severity: Critical 9.9 - Published: Aug 28, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55559](https://cve.now/CVE-2026-55559): Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) - Severity: Critical 9.8 - Published: Aug 28, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55552](https://cve.now/CVE-2026-55552): Yamcs: Unauthenticated Directory Traversal - Severity: High 7.5 - Published: Aug 28, 2026 - Affected: fixed in 5.12.0. - Fixed in 5.12.0 (released Jul 16, 2025, 408 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55549](https://cve.now/CVE-2026-55549): Yamcs: Reflected XSS in the URL of the Authorize Endpoint - Severity: Medium 6.5 - Published: Aug 28, 2026 - Affected: fixed in 5.9.4. - Fixed in 5.9.4 (released Apr 11, 2024, 869 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55547](https://cve.now/CVE-2026-55547): Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security… - Severity: Medium 4.3 - Published: Aug 28, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55545](https://cve.now/CVE-2026-55545): Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce - Severity: Medium 6.5 - Published: Aug 28, 2026 - Affected: fixed in 5.12.8; from 5.13.0, fixed in 5.13.2. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55521](https://cve.now/CVE-2026-55521): Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API - Severity: High 8.8 - Published: Aug 28, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55511](https://cve.now/CVE-2026-55511): Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs \`executeSql\` - Severity: Critical 9.1 - Published: Aug 28, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 45 days before disclosure) and 5.13.2 (released Jul 14, 2026, 45 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-55548](https://cve.now/CVE-2026-55548): Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets - Severity: Medium 4.3 - Published: Jul 16, 2026 - Affected: from 5.13.0, fixed in 5.13.2; fixed in 5.12.8. - Fixed in 5.12.8 (released Jul 14, 2026, 2 days before disclosure) and 5.13.2 (released Jul 14, 2026, 2 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-46621](https://cve.now/CVE-2026-46621): Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection - Severity: Critical 9.1 - Published: Jul 16, 2026 - Affected: fixed in 5.12.7. - Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-46562](https://cve.now/CVE-2026-46562): Yamcs: Remote Code Execution via Mission Database algorithm override - Severity: Critical 9.8 - Published: Jul 16, 2026 - Affected: fixed in 5.12.7. - Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-44632](https://cve.now/CVE-2026-44632): Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in \`JavaExprAlgorithmExecutionFactory\` - Severity: Critical 9.1 - Published: Jul 16, 2026 - Affected: fixed in 5.12.7. - Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-44596](https://cve.now/CVE-2026-44596): Yamcs: No Rate Limiting on Authentication Endpoint - Severity: Medium 6.5 - Published: Jul 16, 2026 - Affected: fixed in 5.12.7. - Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-44595](https://cve.now/CVE-2026-44595): Yamcs: Unauthorized user enumeration via IAM API endpoints - Severity: Medium 4.3 - Published: Jul 16, 2026 - Affected: fixed in 5.12.7. - Fixed in 5.12.7 (released May 21, 2026, 56 days before disclosure). - The latest release, 5.14.0, is not affected. ### [CVE-2026-42568](https://cve.now/CVE-2026-42568): Yamcs Vulnerable to LDAP Injection in LdapAuthModule - Severity: Medium 4.3 - Published: Jun 10, 2026 - Affected: fixed in 5.12.7. - Fixed in 5.12.7 (released May 21, 2026, 20 days before disclosure). - The latest release, 5.14.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.yamcs:yamcs-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.