Vulnerabilities in openremote
20 resultsCVE-2026-39842CRITICALOpenRemote is Vulnerable to Expression InjectionEPSS 0.9%CVE-2026-66013CRITICALOpenRemote before 1.26.2 Authentication Bypass via Console RegistrationEPSS 0.7%CVE-2026-62238HIGHOpenRemote < 1.26.0 SQL Injection via Crosstab ExportEPSS 0.5%CVE-2026-81679HIGHOpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification APIEPSS 0.4%CVE-2026-124436HIGHOpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global ResourcesEPSS 0.4%CVE-2026-114661CRITICALOpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel EndpointsEPSS 0.4%CVE-2026-63224HIGHOpenRemote has authenticated SQL injection in crosstab datapoint exportsEPSS 0.3%CVE-2026-56784HIGHOpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion EndpointEPSS 0.3%CVE-2026-73616HIGHOpenRemote Notification Delete Cross-Realm Insecure Direct Object ReferenceEPSS 0.3%CVE-2026-54641HIGHOpenRemote: Cross-Realm User Information Disclosure in UserResourceImplEPSS 0.3%CVE-2026-41166HIGHOpenRemote has Improper Access Control via updateUserRealmRoles functionEPSS 0.3%CVE-2026-49439MEDIUMOpenRemote read-only asset users can write predicted datapointsEPSS 0.3%CVE-2026-40882HIGHOpenRemote has XXE in Velbus Asset ImportEPSS 0.3%CVE-2026-116184LOWOpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via WebsocketEPSS 0.2%CVE-2026-67310MEDIUMopenremote before 1.27.0 Cross-Tenant IDOR via setAssetLinksEPSS 0.2%CVE-2026-65009MEDIUMOpenRemote before 1.26.2 Information Disclosure via Syslog REST APIEPSS 0.2%CVE-2026-54640HIGHOpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactoryEPSS 0.2%CVE-2026-116186LOWOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdEPSS 0.2%CVE-2026-116185MEDIUMOpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosEPSS 0.2%CVE-2026-124435MEDIUMOpenRemote before 1.32.2 Stored XSS via Manager Configuration Image UploadEPSS 0.2%