openreplay

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

openreplay records in CISA KEV

No openreplay vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Openreplay 2 records LOW

Records

8 records

TI-2026-40332 CVE-2026-55879

OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover

MEDIUM 43

OpenReplay is a self-hosted session replay suite.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00499 Published 2026-07-10 Fixed in 1.25.0 CWE-79

TI-2026-22713 CVE-2026-28443

OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

LOW 37

OpenReplay is a self-hosted session replay suite.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00396 Published 2026-03-05 Fixed in 1.20.0 CWE-89

TI-2026-33096 CVE-2026-45296

OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant binding

LOW 33

OpenReplay is a self-hosted session replay suite.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00231 Published 2026-05-28 Fixed in 1.26.0 CWE-284

TI-2026-40334 CVE-2026-55881

OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint

LOW 32

OpenReplay is a self-hosted session replay suite.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00427 Published 2026-07-10 Fixed in 1.27.0 CWE-639

TI-2026-40333 CVE-2026-55880

OpenReplay: Cross-user IDOR in notes and dashboard widgets

LOW 31

OpenReplay is a self-hosted session replay suite.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00338 Published 2026-07-10 No fix listed CWE-639

TI-2023-26090 CVE-2023-48226

OpenReplay HTML Injection vulnerability

LOW 30

OpenReplay is a self-hosted session replay suite.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00779 Published 2023-11-21 No fix listed CWE-20

TI-2026-33097 CVE-2026-45297

Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch

LOW 29

OpenReplay is a self-hosted session replay suite.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00207 Published 2026-05-28 Fixed in 1.26.0 CWE-285

TI-2026-41168 CVE-2026-57230

OpenReplay: Authenticated ClickHouse SQL injection via session search

LOW 24

OpenReplay is a self-hosted session replay suite.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00339 Published 2026-07-10 Fixed in 1.27.0 CWE-89

Open these records in search →