CVE-2026-19182 | Medium | 4.3 | 2026-08-13 | An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge… |
CVE-2026-19135 | Medium | 5.4 | 2026-08-13 | A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expressi… |
CVE-2025-53122 | | | 2025-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Inje… |
CVE-2025-53121 | | | 2025-06-26 | Multiple stored XSS were found on different nodes with unsanitized parameters in OpenMNS Horizon 33.0.8 and versions earlier than 33.1.6 on multiple platforms… |
CVE-2023-40314 | Medium | 5.8 | 2023-11-16 |
Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. Th… |
CVE-2023-40612 | Medium | 5.3 | 2023-08-23 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerabl… |
CVE-2023-40315 | Medium | 5.3 | 2023-08-17 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate thei… |
CVE-2023-40313 | High | 7.1 | 2023-08-17 | A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary… |
CVE-2023-40312 | Medium | 6.7 | 2023-08-14 | Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple pla… |
CVE-2023-40311 | Medium | 6.7 | 2023-08-14 | Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platfo… |
CVE-2023-0872 | High | 8.2 | 2023-08-14 | The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of p… |
CVE-2023-0871 | Medium | 5.4 | 2023-08-11 | XXE injection in /rtc/post/ endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE… |
CVE-2023-0870 | High | 8.1 | 2023-03-22 | A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain… |
CVE-2023-0869 | Medium | 5.8 | 2023-02-23 | Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The… |
CVE-2023-0868 | Medium | 6.7 | 2023-02-23 | Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies. U… |
CVE-2023-0867 | Medium | 6.7 | 2023-02-23 | Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an atta… |
CVE-2023-0815 | Medium | 6.8 | 2023-02-23 | Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and… |
CVE-2023-0846 | Medium | 6.7 | 2023-02-22 | Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacke… |