nasa vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-92158 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.High 7.2 · Oct 14, 2026
• CVE-2026-92155 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.High 7.5 · Oct 14, 2026
• CVE-2026-92154 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.High 8.1 · Oct 14, 2026
• CVE-2026-92152 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.Critical 9.3 · Oct 14, 2026
• CVE-2026-92150 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.High 7.5 · Oct 14, 2026
• CVE-2026-92153 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.High 7.1 · Oct 14, 2026
• CVE-2026-92151 F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications.High 7.5 · Oct 14, 2026
• CVE-2026-79954 NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path.High 8.7 · Sep 17, 2026
• CVE-2026-72579 An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gHigh 7.5 · Aug 10, 2026
• CVE-2026-72577 Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station hosCritical 9.8 · Aug 10, 2026
• CVE-2026-18064 An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachaHigh 8.2 · Jul 30, 2026
• CVE-2026-15352 A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS).High 8.2 · Jul 16, 2026
• CVE-2026-22697 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 7.5 · Jan 9, 2026
• CVE-2026-22026 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 8.2 · Jan 9, 2026
• CVE-2026-22023 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 8.2 · Jan 9, 2026
• CVE-2026-21900 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 8.2 · Jan 9, 2026
• CVE-2026-21898 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 8.2 · Jan 9, 2026
• CVE-2026-21897 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 7.3 · Jan 9, 2026
• CVE-2025-64096 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 8.8 · Oct 30, 2025
• CVE-2025-59534 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 7.3 · Sep 23, 2025
• CVE-2025-54878 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aHigh 8.6 · Aug 11, 2025
• CVE-2025-30356 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between aCritical 9.3 · Apr 1, 2025
• CVE-2025-25374 In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causingHigh 7.5 · Mar 25, 2025
• CVE-2025-25373 The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.Critical 9.8 · Mar 25, 2025
• CVE-2025-25372 NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module.High 7.5 · Mar 25, 2025