Skip to content
OpenAdvisories

Vendor

openremote

20 known vulnerabilities.

Products

openremote 15 core 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-66013

    OpenRemote before 1.26.2 Authentication Bypass via Console Registration

    OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification t…

    openremote openremote
  • Critical 10.0
    CVE-2026-39842 Public exploit

    OpenRemote is Vulnerable to Expression Injection

    OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied script…

    openremote openremote io.openremote:openremote-manager Maven