MavenPackage

io.openremote:openremote-manager

8 known vulnerabilities (1 critical, 6 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 1.33.0 (Oct 27, 2026): no advisory affects it
Newest unaffected release: 1.33.0 (Oct 27, 2026), the latest release
Advisories: 8 · 1 critical, 6 high, 1 medium

Dependents: 6
Releases: 70 since 1.2.0 (Dec 18, 2024)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-63224
Affects 1.2.0 to 1.25.0 (1.26.0 is outside it)
CVE-2026-54641
Affects 1.2.0 to 1.24.1 (1.24.2 is outside it)
CVE-2026-49439
Affects 1.2.0 to 1.24.0 (1.24.1 is outside it)
CVE-2026-62238
Affects 1.2.0 to 1.25.0 (1.26.0 is outside it)
CVE-2026-56784
Affects 1.2.0 to 1.24.2 (1.25.0 is outside it)
CVE-2026-40882
Affects 1.2.0 to 1.21.0 (1.22.0 is outside it)
CVE-2026-41166
Affects 1.2.0 to 1.22.0 (1.22.1 is outside it)
CVE-2026-39842
Affects 1.2.0 to 1.21.0 (1.22.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-63224High 7.2
OpenRemote has authenticated SQL injection in crosstab datapoint exports
Affected: fixed in 1.26.0.
Fixed in 1.26.0 (released Jun 30, 2026, 122 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-54641High 7.7
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
Affected: fixed in 1.24.2.
Fixed in 1.24.2 (released Jun 11, 2026, 124 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-49439Medium 4.3
OpenRemote read-only asset users can write predicted datapoints
Affected: fixed in 1.24.1.
Fixed in 1.24.1 (released Jun 1, 2026, 102 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-62238High 7.2
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
Affected: fixed in 1.26.0.
Fixed in 1.26.0 (released Jun 30, 2026, 17 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-56784High 8.6
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
Affected: fixed in 1.25.0.
Fixed in 1.25.0 (released Jun 18, 2026, 5 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-40882High 7.6
OpenRemote has XXE in Velbus Asset Import
Affected: fixed in 1.22.0.
Fixed in 1.22.0 (released Apr 13, 2026, 9 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-41166High 7.0
OpenRemote has Improper Access Control via updateUserRealmRoles function
Affected: fixed in 1.22.1.
Fixed in 1.22.1 (released Apr 20, 2026, 2 days before disclosure).
The latest release, 1.33.0, is not affected.
CVE-2026-39842Critical 10.0
OpenRemote is Vulnerable to Expression Injection
Affected: fixed in 1.22.0.
Fixed in 1.22.0 (released Apr 13, 2026, 1 day before disclosure).
The latest release, 1.33.0, is not affected.