Skip to content
OpenAdvisories

Vendor

OSC

7 known vulnerabilities.

Products

ondemand 7
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-44371

    Open OnDemand: Specially crafted filenames can execute javascript in the file browser

    Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This vulnerability is fixed in 4.0.11, 4.1.5, and 4.2.2.

    OSC ondemand
  • Medium 6.3
    CVE-2026-26002

    OnDemand susceptible to malicious input when navigating to a directory.

    Open OnDemand is an open-source high-performance computing portal. The Files application in OnDemand versions prior to 4.0.9 and 4.1.3 is susceptible to malicious input when navigating to a directory. This has been patched in versions 4.0.9 and 4.1.3. Version…

    OSC ondemand
  • Medium 6.9
    CVE-2025-64185

    Open OnDemand RPM packages create world writable locations

    Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.

    OSC ondemand
  • Medium 4.3
    CVE-2025-62724

    Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)

    Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use…

    OSC ondemand
  • Medium 4.1
    CVE-2025-58435

    Open OnDemand didn't rotate password for VNC batch_connect

    Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to sha…

    OSC ondemand
  • Medium 5.4
    CVE-2025-53636

    Open OnDemand Shell App closed websocket DoS

    Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is…

    OSC ondemand