The OpenNMS Group Horizon

• CVE-2026-111252 Medium 6.5 OpenNMS denial of service via XML entity expansion 0.2%
• CVE-2026-111235 Critical 9.1 OpenNMS REST authorization bypass via non-canonical HTTP method 0.4%
• CVE-2026-89089 Medium 6.5 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) 0.4%
• CVE-2026-19596 Medium 5.9 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host 0.3%
• CVE-2026-89054 High 8.2 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes 0.5%
• CVE-2026-19182 Medium 4.3 OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only 0.3%
• CVE-2026-19135 Medium 5.4 OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes 0.3%
• CVE-2025-53122 Medium 6.9 SQLi in OpenNMS Horizon and Meridian 0.2%
• CVE-2025-53121 Medium 6.9 Stored XSS in multiple 33.0.8files in opennms/opennms 0.2%
• CVE-2023-40314 Medium 5.8 Cross-site scripting in bootstrap.jsp 0.4%
• CVE-2023-40612 Medium 5.3 Authenticated XXE Injection Via The File Editor 0.4%
• CVE-2023-40315 Medium 5.3 ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN 2.9%
• CVE-2023-40313 High 7.1 Disable BeanShell Interpreter Remote Server Mode 0.8%
• CVE-2023-40312 Medium 6.7 Reflected XSS in multiple JSP files in opennms/opennms 0.6%
• CVE-2023-40311 Medium 6.7 Stored XSS in multiple JSP files in opennms/opennms 0.7%
• CVE-2023-0872 High 8.2 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users 3.3%
• CVE-2023-0871 Medium 5.4 An XML External Entity injection vulnerability 0.5%
• CVE-2023-0870 High 8.1 Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) 0.3%
• CVE-2023-0815 Medium 6.8 Plaintext Password Present in the Web logs 0.6%
• CVE-2023-0867 Medium 6.7 Multiple stored and reflected Cross-site Scripting in webapp 0.4%
• CVE-2023-0868 Medium 6.7 Stealing Cookies using Reflected XSS via graph results 0.4%
• CVE-2023-0869 Medium 5.8 Cross-site scripting in outage/list.htm 0.4%
• CVE-2023-0846 Medium 6.7 Unauthenticated, stored XSS in display of alarm reduction-key 0.5%