NASA has 16 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 13 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 12. The median CVSS is 7.2 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-617 (6) and CWE-190 (5). Most affected products: fprime (11), CryptoLib (2), core_flight_system (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 13 prev 0
Products
- fprime 11
- CryptoLib 2
- core_flight_system 2
- cFS 1
Worst active — by depth score
CVE-2026-92154High· 8.1F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications57CVE-2026-92151High· 7.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications53CVE-2026-92150High· 7.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications53CVE-2026-92152Critical· 9.3F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications51CVE-2026-92159Medium· 6.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications48
NASA vulnerabilities
CVEs affecting NASA, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-92160Medium· 6.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses f…
CVE-2026-92159Medium· 6.5PoCF´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into…
CVE-2026-92158High· 7.2F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controll…
CVE-2026-92157Medium· 6.5PoCF´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus …
CVE-2026-92156Medium· 6.5PoCF´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventMan…
CVE-2026-92155High· 7.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserializat…
CVE-2026-92154High· 8.1PoCF´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component …
CVE-2026-92152Critical· 9.3F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field i…
CVE-2026-92150High· 7.5PoCF´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive handl…
CVE-2026-92153High· 7.1F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the …
CVE-2026-92151High· 7.5PoCF´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataIn_handler is vulnerable because the handler treats the mini…
CVE-2026-105164Low· 2.7A flaw has been found in NASA cFS up to 7.0.1
A flaw has been found in NASA cFS up to 7.0.1. This issue affects the function CFE_FS_ParseInputFileNameEx of the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This manipulation causes out-of-bounds read. Remote exploitation of the attack is…
CVE-2026-79954High· 8.7NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but…
CVE-2026-5476Medium· 4.6A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit
A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c. The manipulation leads to integer overflow. The comple…
CVE-2026-5475Medium· 5.5A vulnerability was determined in NASA cFS up to 7.0.0
A vulnerability was determined in NASA cFS up to 7.0.0. This impacts the function CFE_SB_TransmitMsg of the file cfe_sb_priv.c of the component CCSDS Header Size Handler. Executing a manipulation can lead to memory corruption. The projec…
CVE-2025-59534High· 7.3CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior …