io.openremote:openremote-manager vulnerabilities

CVEs whose affected-version data names the io.openremote:openremote-manager package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

6 CVEsRSS

CVE-2026-54641High· 7.7PoC

2w ago

OpenRemote is an open-source internet-of-things platform

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with t…

▾ Midnightopenremote · io.openremote:openremote-managerEPSS 0.29%via NVD

CVE-2026-57168Critical· 9.6

1mo ago

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-56120. Reason: This candidate is a duplicate of CVE-2026-56120. Notes: All CVE users should reference CVE-2026-56120 instead of this candidate.

▾ Midnightopenremote · io.openremote:openremote-managervia NVD

GHSA-cgfv-jrfp-2r7vHigh

3mo ago

OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export

▾ Twilightopenremote · io.openremote:openremote-managervia GHSA

GHSA-vjr9-f93j-mjr7High· 8.1

4mo ago

Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

▾ Twilightopenremote · io.openremote:openremote-managervia GHSA

CVE-2026-56120Critical· 9.6

4mo ago

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

▾ Midnightopenremote · io.openremote:openremote-managervia GHSA

GHSA-h3m5-97jq-qjrfCritical· 9.6

4mo ago

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

▾ Midnightopenremote · io.openremote:openremote-managervia GHSA