HO
Product
Horizon
23
CVEs
0
On KEV
9.1
Max CVSS
2
New 30D
Severity mix
Critical 1High 5Medium 17Low 0
Watch
Add Horizon to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-53122 | 6.9 | Jun 26 | SQLi in OpenNMS Horizon and Meridian Affected: 25.2.1 before 33.1.6, 33.1.7; 33.0.8 before 33.1.6, 33.1.7 |
| CVE-2025-53121 | 6.9 | Jun 26 | Stored XSS in multiple 33.0.8files in opennms/opennms Affected: 33.0.8 before 33.1.6, 33.1.7 |
| CVE-2023-0870 | 6.7 | Mar 22 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) Affected: All versions, or not specified |
| CVE-2026-111252 | 6.5 | Oct 15 | OpenNMS denial of service via XML entity expansion Affected: 36.0.0 before 36.0.5 |
| CVE-2026-89089 | 6.5 | Sep 10 | OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) Affected: 36.0.0 before 36.0.4 |
| CVE-2023-0815 | 6.5 | Feb 23 | Plaintext Password Present in the Web logs Affected: 26.0.0 before 31.0.4 |
| CVE-2023-40314 | 6.1 | Nov 16 | Cross-site scripting in bootstrap.jsp Affected: 31.0.8 before 32.0.4 |
| CVE-2023-0871 | 6.1 | Aug 11 | An XML External Entity injection vulnerability Affected: 31.0.8 before 32.0.2 |
| CVE-2023-0867 | 6.1 | Feb 23 | Multiple stored and reflected Cross-site Scripting in webapp Affected: 26.0.0 before 31.0.4 |
| CVE-2023-0868 | 6.1 | Feb 23 | Stealing Cookies using Reflected XSS via graph results Affected: 29.0.0 through 31.0.3 |
| CVE-2023-0869 | 6.1 | Feb 23 | Cross-site scripting in outage/list.htm Affected: 29.0.0 before 31.0.4 |
| CVE-2023-0846 | 6.1 | Feb 22 | Unauthenticated, stored XSS in display of alarm reduction-key Affected: 26.1.0 before 31.0.4 |
| CVE-2026-19596 | 5.9 | Sep 10 | OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host Affected: 36.0.0 before 36.0.4 |
| CVE-2026-19135 | 5.4 | Aug 13 | OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes Affected: 36.0.0 before 36.0.3 |
| CVE-2023-40312 | 5.2 | Aug 14 | Reflected XSS in multiple JSP files in opennms/opennms Affected: 31.0.8 before 32.0.2 |
| CVE-2023-40311 | 4.8 | Aug 14 | Stored XSS in multiple JSP files in opennms/opennms Affected: 31.0.8 before 32.0.2 |
| CVE-2026-19182 | 4.3 | Aug 13 | OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only Affected: 36.0.0 before 36.0.3 |
Showing 17