OP
Vendor
openremote
18
CVEs
0
On KEV
6
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116186 New | CO core openremote | 2.3 | Oct 25 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId |
| CVE-2026-116185 New | CO core openremote | 5.0 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos |
| CVE-2026-116184 New | CO core openremote | 2.1 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket |
| CVE-2026-114661 New | OP openremote openremote | 8.5 | Oct 22 | OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints |
| CVE-2026-54641 | OP openremote openremote | 7.7 | Oct 13 | OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl |
| CVE-2026-54640 | OP openremote openremote | 7.6 | Oct 13 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory |
| CVE-2026-49439 | OP openremote openremote | 4.3 | Sep 11 | OpenRemote read-only asset users can write predicted datapoints |
| CVE-2026-81679 | OP openremote openremote | 7.7 | Aug 27 | OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API |
| CVE-2026-73616 | OP openremote openremote | 6.5 | Aug 13 | OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference |
| CVE-2026-67310 | OP openremote openremote | 5.4 | Aug 1 | openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks |
| CVE-2026-66013 | OP openremote openremote | 9.3 | Jul 25 | OpenRemote before 1.26.2 Authentication Bypass via Console Registration |
| CVE-2026-65009 | OP openremote openremote | 4.3 | Jul 21 | OpenRemote before 1.26.2 Information Disclosure via Syslog REST API |
| CVE-2026-62238 | OP openremote openremote | 8.8 | Jul 17 | OpenRemote < 1.26.0 SQL Injection via Crosstab Export |
| CVE-2026-56784 | OP openremote openremote | 8.1 | Jun 23 | OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint |
| CVE-2026-40882 | OP openremote openremote | 7.6 | Apr 22 | OpenRemote has XXE in Velbus Asset Import |
| CVE-2026-41166 | OP openremote openremote | 7.0 | Apr 22 | OpenRemote has Improper Access Control via updateUserRealmRoles function |
| CVE-2026-39842 | OP openremote openremote | 9.9 | Apr 14 | OpenRemote is Vulnerable to Expression Injection |
| CVE-2022-31860 | OP Openremote Openremote | 9.8 | Sep 6 | An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule |