cve.bz

openremote core vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.6CVE-2026-124436EPSS 0.4%

    OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global…

  2. 4.6CVE-2026-124435EPSS 0.2%

    OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint…

  3. 2.3CVE-2026-116186EPSS 0.2%

    OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An att…

  4. 5.3CVE-2026-116185EPSS 0.2%

    OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoin…

  5. 2.1CVE-2026-116184EPSS 0.2%

    OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one re…