horizon vulnerabilities
CVEs whose affected-version data names the horizon package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
13 CVEsRSS
CVE-2026-111252Medium· 6.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entitie…
CVE-2026-111235Critical· 9.1An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an upp…
CVE-2026-89089Medium· 6.5A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "…
CVE-2026-19596Medium· 5.9An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitor…
CVE-2026-89054High· 8.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the ship…
CVE-2026-55748Medium· 6.0OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types…
CVE-2026-43002Medium· 5.3An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression…
CVE-2014-0157MediumOpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
CVE-2017-7400Medium· 4.8OpenStack Horizon Cross-site Scripting (XSS)
OpenStack Horizon Cross-site Scripting (XSS)
CVE-2014-3474LowOpenStack Horizon Cross-site scripting (XSS) vulnerability
OpenStack Horizon Cross-site scripting (XSS) vulnerability
CVE-2016-4428Medium· 5.4OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
CVE-2014-3473MediumHorizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
CVE-2014-3594LowOpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface