openremote vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

OP

Product

openremote

by openremote · last CVE Oct 22, 2026

15

CVEs

0

On KEV

9.9

Max CVSS

3

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 3High 8Medium 4Low 0

Severity

All severities15 Critical3 High8 Medium4 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add openremote to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-62238	8.8	0%	Jul 17	OpenRemote < 1.26.0 SQL Injection via Crosstab Export Affected: before 1.26.0
CVE-2026-114661 New	8.5	0%	Oct 22	OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints Affected: 1.2.0 before 1.31.0
CVE-2026-56784	8.1	0%	Jun 23	OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint Affected: before 1.25.0
CVE-2026-54641	7.7	0%	Oct 13	OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl Affected: < 1.24.2
CVE-2026-81679	7.7	0%	Aug 27	OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API Affected: before 1.28.0
CVE-2026-54640	7.6	0%	Oct 13	OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory Affected: < 1.24.2
CVE-2026-40882	7.6	0%	Apr 22	OpenRemote has XXE in Velbus Asset Import Affected: < 1.22.0
CVE-2026-41166	7.0	0%	Apr 22	OpenRemote has Improper Access Control via updateUserRealmRoles function Affected: < 1.22.1