# Nasa vulnerabilities Source: https://junglewise.ai/threats/vendors/nasa Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/nasa.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 32 vulnerabilities in Nasa: 1 in the last 7 days and 17 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123664, was published on 6 November 2026. 10 vulnerabilities in the last four weeks, up 900% on the four before (1). 3 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 10 - Last 90 days: 17 - All time: 32 (3 critical, 0 exploited in the wild) ## About Nasa The National Aeronautics and Space Administration is an independent agency of the U.S. federal government responsible for the civil space program, aeronautics research, and space research. ## Latest Nasa vulnerabilities - [CVE-2026-123664: NASA GCN Email Notification Handler authorization bypass](https://junglewise.ai/threats/cve-2026-123664-a-security-flaw-has-been-discovered-in-nasa-gcn-gcn-nasa-gov-up) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-92160: NASA F Prime FileDownlink integer overflow bypass](https://junglewise.ai/threats/cve-2026-92160-f-f-prime-is-a-framework-that-enables-development-and-deployment) (medium, CVSS 6.5, published 14 Oct 2026) - [CVE-2026-92159: F Prime TlmPacketizer buffer overflow in telemetry handler](https://junglewise.ai/threats/cve-2026-92159-f-f-prime-is-a-framework-that-enables-development-and-deployment) (medium, CVSS 6.5, published 14 Oct 2026) - [CVE-2026-92158: F Prime integer wraparound in FpySequencer STORE bounds check](https://junglewise.ai/threats/cve-2026-92158-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 7.2, published 14 Oct 2026) - [CVE-2026-92157: F Prime FileDownlink SendPartial integer overflow denial of service](https://junglewise.ai/threats/cve-2026-92157-f-f-prime-is-a-framework-that-enables-development-and-deployment) (medium, CVSS 6.5, published 14 Oct 2026) - [CVE-2026-92156: F Prime EventManager denial of service via oversized log packet](https://junglewise.ai/threats/cve-2026-92156-f-f-prime-is-a-framework-that-enables-development-and-deployment) (medium, CVSS 6.5, published 14 Oct 2026) - [CVE-2026-92155: F Prime FilePacket deserialization denial of service](https://junglewise.ai/threats/cve-2026-92155-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-92154: F Prime FileUplink integer overflow in handleDataPacket](https://junglewise.ai/threats/cve-2026-92154-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 8.1, published 14 Oct 2026) - [CVE-2026-92152: F´ (F Prime) GenericHub array out-of-bounds in deserialization](https://junglewise.ai/threats/cve-2026-92152-f-f-prime-is-a-framework-that-enables-development-and-deployment) (info, published 14 Oct 2026) - [CVE-2026-92150: F Prime GenericHub deserialization denial of service](https://junglewise.ai/threats/cve-2026-92150-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-79954: NASA CryptoLib authentication downgrade in Telecommand receive](https://junglewise.ai/threats/cve-2026-79954-nasa-cryptolib-authentication-downgrade-in-telecommand-receive) (info, published 18 Sep 2026) - [CVE-2026-84484: NASA ION-DTN out-of-bounds read in decodeSdnv](https://junglewise.ai/threats/cve-2026-84484-nasa-ion-dtn-out-of-bounds-read-in-decodesdnv) (high, CVSS 7.5, published 2 Sep 2026) - [CVE-2026-82802: NASA Earthdata Search server-side request forgery in OpenSearch endpoint](https://junglewise.ai/threats/cve-2026-82802-nasa-earthdata-search-server-side-request-forgery-in-opensearch) (medium, CVSS 5.3, published 31 Aug 2026) - [CVE-2026-82801: NASA Earthdata Search server-side request forgery in scale endpoint](https://junglewise.ai/threats/cve-2026-82801-nasa-earthdata-search-server-side-request-forgery-in-scale) (high, CVSS 7.3, published 31 Aug 2026) - [CVE-2026-82480: NASA cFS integer underflow in CFE_SB_GetUserDataLength](https://junglewise.ai/threats/cve-2026-82480-nasa-cfs-integer-underflow-in-cfe-sb-getuserdatalength) (high, CVSS 7.4, published 30 Aug 2026) - [CVE-2026-82479: NASA cFS buffer overflow in SBN TCP Module](https://junglewise.ai/threats/cve-2026-82479-nasa-cfs-buffer-overflow-in-sbn-tcp-module) (medium, CVSS 6.3, published 30 Aug 2026) - [CVE-2026-82478: NASA Trick stack-based buffer overflow in JSONVariableServer](https://junglewise.ai/threats/cve-2026-82478-nasa-trick-stack-based-buffer-overflow-in-jsonvariableserver) (high, CVSS 7.3, published 30 Aug 2026) - [CVE-2026-72579: NASA HyperCP OS command injection via DNS spoofing](https://junglewise.ai/threats/cve-2026-72579-nasa-hypercp-os-command-injection-via-dns-spoofing) (high, CVSS 7.5, published 10 Aug 2026) - [CVE-2026-72577: NASA fprime-gds unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-72577-nasa-fprime-gds-unauthenticated-remote-code-execution) (critical, CVSS 9.8, published 10 Aug 2026) - [CVE-2026-67979: NASA cFS Executive Services arbitrary code execution via module loading](https://junglewise.ai/threats/cve-2026-67979-nasa-cfs-executive-services-arbitrary-code-execution-via-module) (critical, CVSS 9.1, published 4 Aug 2026) - [CVE-2026-18064: NASA core Flight System NULL pointer dereference in HS application](https://junglewise.ai/threats/cve-2026-18064-nasa-core-flight-system-null-pointer-dereference-in-hs) (high, CVSS 7.5, published 30 Jul 2026) - [CVE-2026-47731: NASA AMMOS AIT-Core path traversal in Binary Stream Capture](https://junglewise.ai/threats/cve-2026-47731-nasa-ammos-ait-core-path-traversal-in-binary-stream-capture) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-15352: NASA Core Flight System NULL pointer dereference in HS application](https://junglewise.ai/threats/cve-2026-15352-nasa-core-flight-system-null-pointer-dereference-in-hs) (high, CVSS 7.5, published 16 Jul 2026) - [CVE-2018-25367: NASA openVSP buffer overflow in geometry name field](https://junglewise.ai/threats/cve-2018-25367-nasa-openvsp-buffer-overflow-in-geometry-name-field) (medium, CVSS 6.2, published 25 May 2026) - [CVE-2026-41144: NASA F Prime integer overflow and arbitrary file write in FileUplink](https://junglewise.ai/threats/cve-2026-41144-nasa-f-prime-integer-overflow-and-arbitrary-file-write-in) (info, CVSS 0, published 22 Apr 2026) ## Most severe Nasa vulnerabilities - [CVE-2026-72577: NASA fprime-gds unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-72577-nasa-fprime-gds-unauthenticated-remote-code-execution) (critical, CVSS 9.8, published 10 Aug 2026) - [CVE-2026-47731: NASA AMMOS AIT-Core path traversal in Binary Stream Capture](https://junglewise.ai/threats/cve-2026-47731-nasa-ammos-ait-core-path-traversal-in-binary-stream-capture) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-67979: NASA cFS Executive Services arbitrary code execution via module loading](https://junglewise.ai/threats/cve-2026-67979-nasa-cfs-executive-services-arbitrary-code-execution-via-module) (critical, CVSS 9.1, published 4 Aug 2026) - [CVE-2026-92154: F Prime FileUplink integer overflow in handleDataPacket](https://junglewise.ai/threats/cve-2026-92154-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 8.1, published 14 Oct 2026) - [CVE-2026-72579: NASA HyperCP OS command injection via DNS spoofing](https://junglewise.ai/threats/cve-2026-72579-nasa-hypercp-os-command-injection-via-dns-spoofing) (high, CVSS 7.5, published 10 Aug 2026) - [CVE-2026-84484: NASA ION-DTN out-of-bounds read in decodeSdnv](https://junglewise.ai/threats/cve-2026-84484-nasa-ion-dtn-out-of-bounds-read-in-decodesdnv) (high, CVSS 7.5, published 2 Sep 2026) - [CVE-2026-92150: F Prime GenericHub deserialization denial of service](https://junglewise.ai/threats/cve-2026-92150-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-92155: F Prime FilePacket deserialization denial of service](https://junglewise.ai/threats/cve-2026-92155-f-f-prime-is-a-framework-that-enables-development-and-deployment) (high, CVSS 7.5, published 14 Oct 2026) - [CVE-2026-18064: NASA core Flight System NULL pointer dereference in HS application](https://junglewise.ai/threats/cve-2026-18064-nasa-core-flight-system-null-pointer-dereference-in-hs) (high, CVSS 7.5, published 30 Jul 2026) - [CVE-2026-15352: NASA Core Flight System NULL pointer dereference in HS application](https://junglewise.ai/threats/cve-2026-15352-nasa-core-flight-system-null-pointer-dereference-in-hs) (high, CVSS 7.5, published 16 Jul 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 900% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 3 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 9 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Nasa technologies - [Nasa F Prime](https://junglewise.ai/threats/technologies/f-prime): 9 vulnerabilities - [Nasa core Flight System](https://junglewise.ai/threats/technologies/core-flight-system): 4 vulnerabilities - [Nasa Open MCT](https://junglewise.ai/threats/technologies/open-mct): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Nasa vulnerabilities", https://junglewise.ai/threats/vendors/nasa, 9 November 2026.