openremote
- Software type
- Other
- Total vulnerabilities (90 days)
- 7
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/10/2026, openremote recorded 7 security vulnerabilities in the last 90 days, of which 4 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of openremote and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-49439OpenRemote read-only asset users can write predicted datapointsCVE-2026-81679OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification APICVE-2026-73616OpenRemote Notification Delete Cross-Realm Insecure Direct Object ReferenceCVE-2026-67310openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinksCVE-2026-66013OpenRemote before 1.26.2 Authentication Bypass via Console Registration| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-49439OpenRemote read-only asset users can write predicted datapoints | Exploitation statusNot exploited | FixNo | Published09/11/2026 | SeverityMedium |
CVE-2026-81679OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API | Exploitation statusNot exploited | FixYes | Published08/27/2026 | SeverityHigh |
CVE-2026-73616OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference | Exploitation statusActively exploited | FixNo | Published08/13/2026 | SeverityHigh |
CVE-2026-67310openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks | Exploitation statusNot exploited | FixYes | Published08/01/2026 | SeverityMedium |
CVE-2026-66013OpenRemote before 1.26.2 Authentication Bypass via Console Registration | Exploitation statusNot exploited | FixYes | Published07/25/2026 | SeverityCritical |
CVE-2026-65009OpenRemote before 1.26.2 Information Disclosure via Syslog REST API | Exploitation statusActively exploited | FixYes | Published07/21/2026 | SeverityMedium |
CVE-2026-62238OpenRemote < 1.26.0 SQL Injection via Crosstab Export | Exploitation statusActively exploited | FixYes | Published07/17/2026 | SeverityHigh |
CVE-2026-56120CVE-2026-56120 | Exploitation statusNot confirmed | FixNo | Published06/23/2026 | SeverityUnknown |
CVE-2026-56784OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint | Exploitation statusActively exploited | FixYes | Published06/23/2026 | SeverityHigh |
CVE-2026-40882OpenRemote has XXE in Velbus Asset Import | Exploitation statusActively exploited | FixNo | Published04/22/2026 | SeverityHigh |
13 Results | Page 1 of 2