Horizon
The OpenNMS Group- Software type
- —
- Catalog vulnerabilities
- 21
Severity across 21 analyzed records
Verify to analyze this security profile
A short verification protects source data and prevents automated AI requests.
en
Severity across 21 analyzed records
A short verification protects source data and prevents automated AI requests.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
As of 09/11/2026, within CyStack's analyzed data, Horizon has 5 security vulnerabilities published in the last 90 days. Of these, 1 is rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Horizon and determine which vulnerabilities affect that version.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-89089OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) | Exploitation statusNot confirmed | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-19596OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host | Exploitation statusNot known exploited | FixYes | Published09/10/2026 | SeverityMedium |
CVE-2026-89054OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes | Exploitation statusNot known exploited | FixYes | Published09/10/2026 | SeverityHigh |
CVE-2026-19182OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-19135OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2025-53122SQLi in OpenNMS Horizon and Meridian | Exploitation statusNot known exploited | FixYes | Published06/26/2025 | SeverityMedium |
CVE-2025-53121Stored XSS in multiple 33.0.8files in opennms/opennms | Exploitation statusNot known exploited | FixYes | Published06/26/2025 | SeverityMedium |
CVE-2023-40314Cross-site scripting in bootstrap.jsp | Exploitation statusNot known exploited | FixYes | Published11/16/2023 | SeverityMedium |
CVE-2023-40612Authenticated XXE Injection Via The File Editor | Exploitation statusNot known exploited | FixYes | Published08/23/2023 | SeverityMedium |
CVE-2023-40315ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN | Exploitation statusNot known exploited | FixYes | Published08/17/2023 | SeverityMedium |
CVE-2023-40313Disable BeanShell Interpreter Remote Server Mode | Exploitation statusNot known exploited | FixYes | Published08/17/2023 | SeverityHigh |
CVE-2023-40312Reflected XSS in multiple JSP files in opennms/opennms | Exploitation statusNot known exploited | FixYes | Published08/14/2023 | SeverityMedium |
CVE-2023-40311Stored XSS in multiple JSP files in opennms/opennms | Exploitation statusNot known exploited | FixYes | Published08/14/2023 | SeverityMedium |
CVE-2023-0872ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users | Exploitation statusNot known exploited | FixYes | Published08/14/2023 | SeverityHigh |
CVE-2023-0871An XML External Entity injection vulnerability | Exploitation statusNot known exploited | FixYes | Published08/11/2023 | SeverityMedium |
CVE-2023-0870Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) | Exploitation statusNot known exploited | FixYes | Published03/22/2023 | SeverityHigh |
CVE-2023-0815Plaintext Password Present in the Web logs | Exploitation statusNot known exploited | FixYes | Published02/23/2023 | SeverityMedium |
CVE-2023-0867Multiple stored and reflected Cross-site Scripting in webapp | Exploitation statusNot confirmed | FixYes | Published02/23/2023 | SeverityMedium |
CVE-2023-0868Stealing Cookies using Reflected XSS via graph results | Exploitation statusNot confirmed | FixYes | Published02/23/2023 | SeverityMedium |
CVE-2023-0869Cross-site scripting in outage/list.htm | Exploitation statusNot confirmed | FixYes | Published02/23/2023 | SeverityMedium |
CVE-2023-0846Unauthenticated, stored XSS in display of alarm reduction-key | Exploitation statusNot confirmed | FixYes | Published02/22/2023 | SeverityMedium |