CVE-2026-42087

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-420888.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0 CVE-2026-420898.6Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions CVE-2026-42099.8A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS CVE-2026-420909.6Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop version 3.3.15 and prior to Notesnook i CVE-2026-420916.5goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token valida CVE-2026-420926.5titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without CVE-2026-420938.7Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/que CVE-2026-420954.0bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.CVE-2026-420968.8Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any CVE-2026-420978.8Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model n CVE-2026-420988.7Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attac CVE-2026-420997.5Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the p