Oopenremote

Products

Exploited and recent CVEs

• CVE-2026-63224 High 7.2 OpenRemote has authenticated SQL injection in crosstab datapoint exports 0.3%
• CVE-2026-116186 Low 2.3 OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId 0.2%
• CVE-2026-116185 Medium 5.0 OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos 0.2%
• CVE-2026-116184 Low 2.1 OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket 0.2%
• CVE-2026-114661 High 8.5 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints 0.4%
• CVE-2026-54641 High 7.7 OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl 0.3%
• CVE-2026-54640 High 7.6 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory 0.2%
• CVE-2026-49439 Medium 4.3 OpenRemote read-only asset users can write predicted datapoints 0.3%
• CVE-2026-81679 High 7.7 OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API 0.4%
• CVE-2026-73616 Medium 6.5 OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference 0.3%
• CVE-2026-67310 Medium 5.4 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks 0.2%
• CVE-2026-66013 Critical 9.3 OpenRemote before 1.26.2 Authentication Bypass via Console Registration 0.7%
• CVE-2026-65009 Medium 4.3 OpenRemote before 1.26.2 Information Disclosure via Syslog REST API 0.2%
• CVE-2026-62238 High 7.2 OpenRemote < 1.26.0 SQL Injection via Crosstab Export 0.5%
• CVE-2026-56784 High 8.1 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint 0.3%
• CVE-2026-40882 High 7.6 OpenRemote has XXE in Velbus Asset Import 0.3%
• CVE-2026-41166 High 7.0 OpenRemote has Improper Access Control via updateUserRealmRoles function 0.3%
• CVE-2026-39842 Critical 10.0 OpenRemote is Vulnerable to Expression Injection 0.9%