Advisories · Technology

OSC ondemand.

Every CVE that names OSC ondemand among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-44371 CVE record

CVSS 5.3 Medium

Open OnDemand: Specially crafted filenames can execute javascript in the file browser
- OSC ondemand
- Cross-site scripting (XSS)
Not analysed yet 14 May 2026
CVE-2026-26002 CVE record

CVSS 6.3 Medium

OnDemand susceptible to malicious input when navigating to a directory.
- OSC ondemand
- Other injection
Not analysed yet 4 Mar 2026
CVE-2025-66029 CVE record

CVSS 7.6 High

Open OnDemand affected by Apache proxy passing sensitive headers
- OSC ondemand
- Hard-coded credentials
- CWE-523
Not analysed yet 17 Dec 2025
CVE-2025-64185 CVE record

CVSS 6.9 Medium

Open OnDemand RPM packages create world writable locations
- OSC ondemand
- Information disclosure
- CWE-277
Not analysed yet 20 Nov 2025
CVE-2025-62724 CVE record

CVSS 4.3 Medium

Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)
- OSC ondemand
- Race condition
- CWE-61
Not analysed yet 20 Nov 2025
CVE-2025-58435 CVE record

CVSS 4.1 Medium

Open OnDemand didn't rotate password for VNC batch_connect
- OSC ondemand
- CWE-262
Not analysed yet 9 Sept 2025
CVE-2025-53636 CVE record

CVSS 5.4 Medium

Open OnDemand Shell App closed websocket DoS
- OSC ondemand
- Denial of service
- CWE-779
Not analysed yet 11 Jul 2025