openremote — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in openremote, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-63224	OpenRemote has authenticated SQL injection in crosstab datapoint exports CWE-89	7.2	High	2026-10-30
CVE-2026-114661	OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints CWE-862	8.5	High	2026-10-22
CVE-2026-54641	OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl CWE-639	7.7	High	2026-10-13
CVE-2026-54640	OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory CWE-611	7.6	High	2026-10-13
CVE-2026-49439	OpenRemote read-only asset users can write predicted datapoints CWE-862	4.3	Medium	2026-09-11
CVE-2026-81679	OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API CWE-200	7.7	High	2026-08-27
CVE-2026-73616	OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference CWE-639	6.5	Medium	2026-08-13
CVE-2026-67310	openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks CWE-863	5.4	Medium	2026-08-01
CVE-2026-66013	OpenRemote before 1.26.2 Authentication Bypass via Console Registration CWE-639	9.3	Critical	2026-07-25
CVE-2026-65009	OpenRemote before 1.26.2 Information Disclosure via Syslog REST API CWE-200	4.3	Medium	2026-07-21
CVE-2026-62238	OpenRemote < 1.26.0 SQL Injection via Crosstab Export CWE-89	7.2	High	2026-07-17
CVE-2026-56784	OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint CWE-639	8.1	High	2026-06-23
CVE-2026-40882	OpenRemote has XXE in Velbus Asset Import CWE-611	7.6	High	2026-04-22
CVE-2026-41166	OpenRemote has Improper Access Control via updateUserRealmRoles function CWE-284	7.0	High	2026-04-22
CVE-2026-39842	OpenRemote is Vulnerable to Expression Injection CWE-94	10.0	Critical	2026-04-14

All 15 known CVE vulnerabilities affecting openremote with full Chinese analysis, references, and POCs where available.