Login Request a demo
OP
Product
openremote
by openremote · last CVE Oct 22, 2026
15
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 3High 8Medium 4Low 0
Severity
All severities15Critical3High8Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add openremote to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-39842
9.9
1%
Apr 14
OpenRemote is Vulnerable to Expression Injection
Affected: < 1.22.0
CVE-2022-31860
9.8
2%
Sep 6
An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
Affected: through 1.0.4
CVE-2026-66013
9.3
1%
Jul 25
OpenRemote before 1.26.2 Authentication Bypass via Console Registration
Affected: before 1.26.2
CVE-2026-62238
8.8
0%
Jul 17
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
Affected: before 1.26.0
CVE-2026-114661
New
8.5
0%
Oct 22
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
Affected: 1.2.0 before 1.31.0
CVE-2026-56784
8.1
0%
Jun 23
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
Affected: before 1.25.0
CVE-2026-54641
7.7
0%
Oct 13
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
Affected: < 1.24.2
CVE-2026-81679
7.7
0%
Aug 27
OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
Affected: before 1.28.0
CVE-2026-54640
7.6
0%
Oct 13
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
Affected: < 1.24.2
CVE-2026-40882
7.6
0%
Apr 22
OpenRemote has XXE in Velbus Asset Import
Affected: < 1.22.0
CVE-2026-41166
7.0
0%
Apr 22
OpenRemote has Improper Access Control via updateUserRealmRoles function
Affected: < 1.22.1
CVE-2026-73616
6.5
0%
Aug 13
OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference
Affected: All versions, or not specified
CVE-2026-67310
5.4
0%
Aug 1
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
Affected: before 1.27.0
CVE-2026-49439
4.3
0%
Sep 11
OpenRemote read-only asset users can write predicted datapoints
Affected: < 1.24.1
CVE-2026-65009
4.3
0%
Jul 21
OpenRemote before 1.26.2 Information Disclosure via Syslog REST API
Affected: before 1.26.2
Showing 15