Skip to content
OpenAdvisories

Vendor

OSC

7 known vulnerabilities.

OSC at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202610
Apr 202600
Mar 202610
Feb 202600
Jan 202600
Dec 202510
Nov 202520
Oct 202500
Sep 202510
Aug 202500
Jul 202510
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

ondemand 7
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2026-44371

    Open OnDemand: Specially crafted filenames can execute javascript in the file browser

    Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This vulnerability is fixed in 4.0.11, 4.1.5, and 4.2.2.

    OSC ondemand
  • Medium 6.3
    CVE-2026-26002

    OnDemand susceptible to malicious input when navigating to a directory.

    Open OnDemand is an open-source high-performance computing portal. The Files application in OnDemand versions prior to 4.0.9 and 4.1.3 is susceptible to malicious input when navigating to a directory. This has been patched in versions 4.0.9 and 4.1.3. Version…

    OSC ondemand
  • High 7.6
    CVE-2025-66029

    Open OnDemand affected by Apache proxy passing sensitive headers

    Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these heade…

    OSC ondemand
  • Medium 6.9
    CVE-2025-64185

    Open OnDemand RPM packages create world writable locations

    Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.

    OSC ondemand
  • Medium 4.3
    CVE-2025-62724

    Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)

    Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use…

    OSC ondemand
  • Medium 4.1
    CVE-2025-58435

    Open OnDemand didn't rotate password for VNC batch_connect

    Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to sha…

    OSC ondemand
  • Medium 5.4
    CVE-2025-53636

    Open OnDemand Shell App closed websocket DoS

    Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is…

    OSC ondemand