pkg:Maven/io.openremote:openremote-manager

All known vulnerabilities

• CRITICAL9.9CVE-2026-39842Expression Injection in OpenRemote
  from 0, < 1.22.0
• CRITICAL9.6CVE-2026-57168OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
  from 0, < 1.25.0
• CRITICAL9.6CVE-2026-56784OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
  from 0, < 1.25.0
• HIGH7.7OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
  from 0, < 1.24.2
• HIGH7.6OpenRemote has XXE in Velbus Asset Import
  from 0, < 1.22.0
• HIGH7.0OpenRemote has Improper Access Control via updateUserRealmRoles function
  from 0, < 1.22.1
• MEDIUM4.3OpenRemote read-only asset users can write predicted datapoints
  from 0, < 1.24.1
• —OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export
  from 0, < 1.26.0