OpenNMS

Latest CVEs · RSS

• CVE-2026-111252 2026-10-15 · CVSS 6.5
  A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit
• CVE-2026-111235 2026-10-15 · CVSS 9.1
  An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains au
• CVE-2026-89089 2026-09-10 · CVSS 6.5
  A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authent
• CVE-2026-19596 2026-09-10 · CVSS 5.9
  An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a so
• CVE-2026-89054 2026-09-10 · CVSS 8.2
  A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST AP
• CVE-2026-19182 2026-08-13 · CVSS 4.3
  An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge,
• CVE-2026-19135 2026-08-13 · CVSS 5.4
  A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expressio
• CVE-2025-53122 2025-06-26 · CVSS 6.9
  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Injec
• CVE-2025-53121 2025-06-26 · CVSS 6.9
  Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms t
• CVE-2023-40314 2023-11-16 · CVSS 5.8
  Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The
• CVE-2023-40612 2023-08-23 · CVSS 5.3
  In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerable
• CVE-2023-40315 2023-08-17 · CVSS 5.3
  In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their
• CVE-2023-40313 2023-08-17 · CVSS 7.1
  A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary
• CVE-2023-40312 2023-08-14 · CVSS 6.7
  Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple plat
• CVE-2023-40311 2023-08-14 · CVSS 6.7
  Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platfor
• CVE-2023-0872 2023-08-14 · CVSS 8.2
  The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of pr
• CVE-2023-0871 2023-08-11 · CVSS 5.4
  XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE)
• CVE-2023-0870 2023-03-22 · CVSS 8.1
  A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain a
• CVE-2023-0815 2023-02-23 · CVSS 6.8
  Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and p
• CVE-2023-0867 2023-02-23 · CVSS 6.7
  Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attac
• CVE-2023-0868 2023-02-23 · CVSS 6.7
  Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. Us
• CVE-2023-0869 2023-02-23 · CVSS 5.8
  Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The
• CVE-2023-0846 2023-02-22 · CVSS 6.7
  Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker