openremote vulnerabilities

Newest CVEs

• CVE-2026-63224

  OpenRemote has authenticated SQL injection in crosstab datapoint exports

  openremote · openremote

  High7.2
• CVE-2026-116186

  OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

  openremote · core

  Low2.3
• CVE-2026-116185

  OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

  openremote · core

  Medium5.3
• CVE-2026-116184

  OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

  openremote · core

  Low2.1
• CVE-2026-114661

  OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints

  openremote · openremote

  Critical9.0
• CVE-2026-54641

  OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl

  openremote · openremote

  High7.7
• CVE-2026-54640

  OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

  openremote · openremote

  High7.6
• CVE-2026-49439

  OpenRemote read-only asset users can write predicted datapoints

  openremote · openremote

  Medium4.3
• CVE-2026-81679

  OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

  openremote · openremote

  High8.3
• CVE-2026-73616

  OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference

  openremote · openremote

  High7.1