Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: openremote Component: Openremote Clear all filters
TI-2026-44461 CVE-2026-62238 · GHSA-rw7h-h988-gfff

OpenRemote < 1.26.0 SQL Injection via Crosstab Export

Priority HIGH 65

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00498 Published 2026-07-17 Fixed in 1.26.0 CWE-89
TI-2026-29538 CVE-2026-40882 · GHSA-g24f-mgc3-jwwc

OpenRemote has XXE in Velbus Asset Import

Priority HIGH 66

OpenRemote is an open-source internet-of-things platform.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00258 Published 2026-04-22 Fixed in 1.22.0 CWE-611