Skip to content
OpenAdvisories

Product · openremote

core

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-124435

    OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload

    OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure…

    openremote core
  • Medium 5.0
    CVE-2026-116185

    OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

    OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own rea…

    openremote core