TO
Vendor
The OpenNMS Group
44
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111252 | ME Meridian The OpenNMS Group | 6.5 | Oct 15 | OpenNMS denial of service via XML entity expansion |
| CVE-2026-111235 | HO Horizon The OpenNMS Group | 9.1 | Oct 15 | OpenNMS REST authorization bypass via non-canonical HTTP method |
| CVE-2026-89089 | HO Horizon The OpenNMS Group | 6.5 | Sep 10 | OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) |
| CVE-2026-19596 | HO Horizon The OpenNMS Group | 5.9 | Sep 10 | OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host |
| CVE-2026-89054 | HO Horizon The OpenNMS Group | 8.2 | Sep 10 | OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes |
| CVE-2026-19182 | ME Meridian The OpenNMS Group | 4.3 | Aug 13 | OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only |
| CVE-2026-19135 | ME Meridian The OpenNMS Group | 5.4 | Aug 13 | OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes |
| CVE-2025-53122 | HO Horizon The OpenNMS Group | 6.9 | Jun 26 | SQLi in OpenNMS Horizon and Meridian |
| CVE-2025-53121 | ME Meridian The OpenNMS Group | 6.9 | Jun 26 | Stored XSS in multiple 33.0.8files in opennms/opennms |
| CVE-2023-40314 | HO Horizon The OpenNMS Group | 6.1 | Nov 16 | Cross-site scripting in bootstrap.jsp |
| CVE-2023-40612 | ME Meridian The OpenNMS Group | 8.0 | Aug 23 | Authenticated XXE Injection Via The File Editor |
| CVE-2023-40315 | ME Meridian The OpenNMS Group | 8.0 | Aug 17 | ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN |
| CVE-2023-40313 | HO Horizon The OpenNMS Group | 8.8 | Aug 17 | Disable BeanShell Interpreter Remote Server Mode |
| CVE-2023-40312 | HO Horizon The OpenNMS Group | 5.2 | Aug 14 | Reflected XSS in multiple JSP files in opennms/opennms |
| CVE-2023-40311 | ME Meridian The OpenNMS Group | 4.8 | Aug 14 | Stored XSS in multiple JSP files in opennms/opennms |
| CVE-2023-0872 | ME Meridian The OpenNMS Group | 8.0 | Aug 14 | ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users |
| CVE-2023-0871 | ME Meridian The OpenNMS Group | 6.1 | Aug 11 | An XML External Entity injection vulnerability |
| CVE-2023-0870 | HO Horizon The OpenNMS Group | 6.7 | Mar 22 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) |
| CVE-2023-0815 | ME Meridian The OpenNMS Group | 6.5 | Feb 23 | Plaintext Password Present in the Web logs |
| CVE-2023-0867 | HO Horizon The OpenNMS Group | 6.1 | Feb 23 | Multiple stored and reflected Cross-site Scripting in webapp |
| CVE-2023-0868 | HO Horizon The OpenNMS Group | 6.1 | Feb 23 | Stealing Cookies using Reflected XSS via graph results |
| CVE-2023-0869 | HO Horizon The OpenNMS Group | 6.1 | Feb 23 | Cross-site scripting in outage/list.htm |
| CVE-2023-0846 | HO Horizon The OpenNMS Group | 6.1 | Feb 22 | Unauthenticated, stored XSS in display of alarm reduction-key |