horizon vulnerabilities
CVEs whose affected-version data names the horizon package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
11 CVEsRSS
CVE-2026-89089Medium· 6.5A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "…
CVE-2026-19596Medium· 5.9An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitor…
CVE-2026-89054High· 8.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the ship…
CVE-2026-55748Medium· 6.0OpenStack Horizon RC file generation does not escape special characters in project names
OpenStack Horizon RC file generation does not escape special characters in project names
CVE-2026-43002Medium· 5.3An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression…
CVE-2014-0157MediumOpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
CVE-2017-7400Medium· 4.8OpenStack Horizon Cross-site Scripting (XSS)
OpenStack Horizon Cross-site Scripting (XSS)
CVE-2014-3474LowOpenStack Horizon Cross-site scripting (XSS) vulnerability
OpenStack Horizon Cross-site scripting (XSS) vulnerability
CVE-2016-4428Medium· 5.4OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
CVE-2014-3473MediumHorizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
CVE-2014-3594LowOpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface