https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-55548.htmlhttps://patchthecve.com/cve/CVE-2026-55548.htmlMon, 20 Jul 2026 01:29:18 +0000MEDIUM 4.3: Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.chhttps://patchthecve.com/cve/CVE-2026-46621.htmlhttps://patchthecve.com/cve/CVE-2026-46621.htmlMon, 20 Jul 2026 01:46:21 +0000CRITICAL 9.1: Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the Chhttps://patchthecve.com/cve/CVE-2026-46562.htmlhttps://patchthecve.com/cve/CVE-2026-46562.htmlMon, 20 Jul 2026 01:53:17 +0000CRITICAL 9.8: Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabashttps://patchthecve.com/cve/CVE-2026-44632.htmlhttps://patchthecve.com/cve/CVE-2026-44632.htmlFri, 17 Jul 2026 18:38:47 +0000CRITICAL 9.1: Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compilhttps://patchthecve.com/cve/CVE-2026-44596.htmlhttps://patchthecve.com/cve/CVE-2026-44596.htmlFri, 17 Jul 2026 18:44:26 +0000MEDIUM 6.5: Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker https://patchthecve.com/cve/CVE-2026-44595.htmlhttps://patchthecve.com/cve/CVE-2026-44595.htmlSat, 18 Jul 2026 03:16:35 +0000MEDIUM 4.3: Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one wit