io.openremote:openremote-manager vulnerabilities
CVEs whose affected-version data names the io.openremote:openremote-manager package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
GHSA-cgfv-jrfp-2r7vHighOpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
▾ Twilightopenremote · io.openremote:openremote-managervia GHSA
CVE-2026-54641High· 7.7OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
▾ Twilightopenremote · io.openremote:openremote-managervia GHSA
CVE-2026-57168Critical· 9.6OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
▾ Midnightopenremote · io.openremote:openremote-managervia GHSA
GHSA-h3m5-97jq-qjrfCritical· 9.6OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
▾ Midnightopenremote · io.openremote:openremote-managervia GHSA