https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-42088.htmlhttps://patchthecve.com/cve/CVE-2026-42088.htmlMon, 26 Oct 2026 19:10:00 +0000CRITICAL 9.6: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the dohttps://patchthecve.com/cve/CVE-2026-42087.htmlhttps://patchthecve.com/cve/CVE-2026-42087.htmlMon, 26 Oct 2026 19:10:00 +0000CRITICAL 9.6: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_modhttps://patchthecve.com/cve/CVE-2026-42086.htmlhttps://patchthecve.com/cve/CVE-2026-42086.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 4.6: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0, the Command Sender UI uses an unsafe eval() function on array-like command parameters, which allows a user-supplied payload to execute in the browser when shttps://patchthecve.com/cve/CVE-2026-42085.htmlhttps://patchthecve.com/cve/CVE-2026-42085.htmlMon, 26 Oct 2026 19:10:00 +0000MEDIUM 4.3: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations ihttps://patchthecve.com/cve/CVE-2026-42084.htmlhttps://patchthecve.com/cve/CVE-2026-42084.htmlMon, 26 Oct 2026 19:10:00 +0000HIGH 8.1: OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid ses