openremote vulnerabilities

Newest CVEs

• CVE-2026-124436

  OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources

  openremote · core

  High8.6
• CVE-2026-124435

  OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload

  openremote · core

  Medium4.6
• CVE-2026-63224

  OpenRemote has authenticated SQL injection in crosstab datapoint exports

  openremote · openremote

  High7.2
• CVE-2026-116186

  OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

  openremote · core

  Low2.3
• CVE-2026-116185

  OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

  openremote · core

  Medium5.3
• CVE-2026-116184

  OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

  openremote · core

  Low2.1
• CVE-2026-114661

  OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints

  openremote · openremote

  Critical9.0
• CVE-2026-54641

  OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl

  openremote · openremote

  High7.7
• CVE-2026-54640

  OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

  openremote · openremote

  High7.6
• CVE-2026-49439

  OpenRemote read-only asset users can write predicted datapoints

  openremote · openremote

  Medium4.3