Opennms / Meridian
23 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-89089 | OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) | MEDIUM | 6.5 | Sep 10, 2026 |
| CVE-2026-19596 | OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host | MEDIUM | 5.9 | Sep 10, 2026 |
| CVE-2026-19182 | OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only | MEDIUM | 4.3 | Aug 13, 2026 |
| CVE-2026-19135 | OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes | MEDIUM | 5.4 | Aug 13, 2026 |
| CVE-2025-53122 | SQLi in OpenNMS Horizon and Meridian | MEDIUM | 6.9 | Jun 26, 2025 |
| CVE-2025-53121 | Stored XSS in multiple 33.0.8files in opennms/opennms | MEDIUM | 6.9 | Jun 26, 2025 |
| CVE-2023-40314 | Cross-site scripting in bootstrap.jsp | MEDIUM | 6.1 | Nov 16, 2023 |
| CVE-2023-40612 | Authenticated XXE Injection Via The File Editor | HIGH | 8.0 | Aug 23, 2023 |
| CVE-2023-40315 | ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN | HIGH | 8.0 | Aug 17, 2023 |
| CVE-2023-40313 | Disable BeanShell Interpreter Remote Server Mode | HIGH | 8.8 | Aug 17, 2023 |
| CVE-2023-40312 | Reflected XSS in multiple JSP files in opennms/opennms | MEDIUM | 6.7 | Aug 14, 2023 |
| CVE-2023-40311 | Stored XSS in multiple JSP files in opennms/opennms | MEDIUM | 6.7 | Aug 14, 2023 |
| CVE-2023-0872 | ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users | HIGH | 8.2 | Aug 14, 2023 |
| CVE-2023-0871 | An XML External Entity injection vulnerability | HIGH | 8.8 | Aug 11, 2023 |
| CVE-2023-0870 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) | HIGH | 8.1 | Mar 22, 2023 |
| CVE-2023-0815 | Plaintext Password Present in the Web logs | MEDIUM | 6.8 | Feb 23, 2023 |
| CVE-2023-0867 | Multiple stored and reflected Cross-site Scripting in webapp | MEDIUM | 6.7 | Feb 23, 2023 |
| CVE-2023-0868 | Stealing Cookies using Reflected XSS via graph results | MEDIUM | 6.7 | Feb 23, 2023 |
| CVE-2023-0869 | Cross-site scripting in outage/list.htm | MEDIUM | 6.1 | Feb 23, 2023 |
| CVE-2023-0846 | Unauthenticated, stored XSS in display of alarm reduction-key | MEDIUM | 6.7 | Feb 22, 2023 |
| CVE-2021-25932 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… | MEDIUM | 5.4 | Jun 1, 2021 |
| CVE-2021-25934 | In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2… | MEDIUM | 5.4 | May 25, 2021 |
| CVE-2021-25935 | In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2… | MEDIUM | 5.4 | May 25, 2021 |
| CVE-2021-25933 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… | MEDIUM | 4.8 | May 20, 2021 |
| CVE-2021-25931 | In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation… | HIGH | 8.8 | May 20, 2021 |
Showing 1 to 23 of 23 CVEs