Vulnerabilities

TI-2026-60371 CVE-2026-89089 · GHSA-fcjx-6cv6-5wqj

OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

LOW 29

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00365 Published 2026-09-10 Fixed in 2024.3.13, 2025.0.10 +1 CWE-89

TI-2026-15924 CVE-2026-19596 · GHSA-9hqx-g6f2-rj2p

LOW 26

An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00337 Published 2026-09-10 Fixed in 2024.3.13, 2025.0.10 +1 CWE-611