What’s Vulnerable › Products
The OpenNMS Group Horizon vulnerabilities
30 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your The OpenNMS Group Horizon version is affected
Latest The OpenNMS Group Horizon vulnerabilities
- CVE-2026-111252 — OpenNMS denial of service via XML entity expansion (CVSS 6.5)
- CVE-2026-111235 — OpenNMS REST authorization bypass via non-canonical HTTP method (CVSS 9.1)
- CVE-2026-89089 — OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) (CVSS 6.5)
- CVE-2026-19596 — OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host (CVSS 5.9)
- CVE-2026-89054 — OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes (CVSS 8.2)
- CVE-2026-19182 — OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only (CVSS 4.3)
- CVE-2026-19135 — OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes (CVSS 5.4)
- CVE-2025-53121 — Stored XSS in multiple 33.0.8files in opennms/opennms (CVSS 6.9)
- CVE-2023-40314 — Cross-site scripting in bootstrap.jsp (CVSS 6.1)
- CVE-2023-40612 — Authenticated XXE Injection Via The File Editor (CVSS 8.0)
- CVE-2023-40315 — ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN (CVSS 8.0)
- CVE-2023-40313 — Disable BeanShell Interpreter Remote Server Mode (CVSS 8.8)
- CVE-2023-40312 — Reflected XSS in multiple JSP files in opennms/opennms (CVSS 5.2)
- CVE-2023-40311 — Stored XSS in multiple JSP files in opennms/opennms (CVSS 4.8)
- CVE-2023-0872 — ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users (CVSS 8.0)
- CVE-2023-0871 — An XML External Entity injection vulnerability (CVSS 6.1)
- CVE-2023-0870 — Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) (CVSS 6.7)
- CVE-2023-0869 — Cross-site scripting in outage/list.htm (CVSS 6.1)
- CVE-2023-0868 — Stealing Cookies using Reflected XSS via graph results (CVSS 6.1)
- CVE-2023-0867 — Multiple stored and reflected Cross-site Scripting in webapp (CVSS 6.1)
- CVE-2023-0815 — Plaintext Password Present in the Web logs (CVSS 6.5)
- CVE-2023-0846 — Unauthenticated, stored XSS in display of alarm reduction-key (CVSS 6.1)
- CVE-2021-25935 — (CVSS 5.4)
- CVE-2021-25934 — (CVSS 5.4)
- CVE-2021-25933 — (CVSS 4.8)