Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

openremote — Vulnerabilities & Security Advisories 18

Browse all 18 CVE security advisories affecting openremote. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates security vulnerability data specifically for the vendor openremote, focusing on weaknesses found in their IoT management platforms and software tags. The collection encompasses a comprehensive range of reported issues, including remote code execution, authentication bypasses, and privilege escalation flaws, covering the time period from the vendor's initial public releases through the most recent security bulletins. Visitors can utilize this resource to track the historical sequence of vendor advisories, analyze the prevalence and impact of specific weakness classes within the openremote ecosystem, and review the complete vulnerability history for any of their deployed products. By consolidating disparate reports into a single view, this archive enables security professionals to perform efficient risk assessments, monitor emerging threat patterns, and verify the remediation status of known defects across the entire product line. The data presented here serves as a factual reference for audit compliance, incident response planning, and long-term security strategy development without relying on external commercial feeds or fragmented information sources. Users seeking to understand the security posture of openremote solutions will find detailed contextual information regarding affected versions, disclosed attack vectors, and recommended mitigation steps for each recorded entry.

Found 15 results / 18 Clear Filters
Top products by openremote: openremote core
CVE ID Title CVSS Severity Published
CVE-2026-63224 OpenRemote has authenticated SQL injection in crosstab datapoint exports — openremote CWE-89 7.2 High 2026-10-30
CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints — openremote CWE-862 8.5 High 2026-10-22
CVE-2026-54641 OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl — openremote CWE-639 7.7 High 2026-10-13
CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory — openremote CWE-611 7.6 High 2026-10-13
CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints — openremote CWE-862 4.3 Medium 2026-09-11
CVE-2026-81679 OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API — openremote CWE-200 7.7 High 2026-08-27
CVE-2026-73616 OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference — openremote CWE-639 6.5 Medium 2026-08-13
CVE-2026-67310 openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks — openremote CWE-863 5.4 Medium 2026-08-01
CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration — openremote CWE-639 9.3 Critical 2026-07-25
CVE-2026-65009 OpenRemote before 1.26.2 Information Disclosure via Syslog REST API — openremote CWE-200 4.3 Medium 2026-07-21
CVE-2026-62238 OpenRemote < 1.26.0 SQL Injection via Crosstab Export — openremote CWE-89 7.2 High 2026-07-17
CVE-2026-56784 OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint — openremote CWE-639 8.1 High 2026-06-23
CVE-2026-40882 OpenRemote has XXE in Velbus Asset Import — openremote CWE-611 7.6 High 2026-04-22
CVE-2026-41166 OpenRemote has Improper Access Control via updateUserRealmRoles function — openremote CWE-284 7.0 High 2026-04-22
CVE-2026-39842 OpenRemote is Vulnerable to Expression Injection — openremote CWE-94 10.0 Critical 2026-04-14

This page lists every published CVE security advisory associated with openremote. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.