Vulnerabilities

TI-2026-32328 CVE-2026-44371

Open OnDemand: Specially crafted filenames can execute javascript in the file browser

LOW 24

Open OnDemand is an open-source high-performance computing portal.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00262 Published 2026-05-14 Fixed in 4.0.11, 4.1.5 +1 CWE-79

TI-2026-21016 CVE-2026-26002

LOW 31

Open OnDemand is an open-source high-performance computing portal.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00607 Published 2026-03-04 Fixed in 4.0.9, 4.1.3 CWE-74

TI-2025-40555 CVE-2025-66029

LOW 33

Open OnDemand provides remote web access to supercomputers.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.002 Published 2025-12-17 No fix listed CWE-522

TI-2025-39628 CVE-2025-64185

LOW 36

Open OnDemand is an open-source HPC portal.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00305 Published 2025-11-20 Fixed in 4.0.8, 3.1.16 CWE-277

TI-2025-38914 CVE-2025-62724

LOW 19

Open OnDemand is an open-source HPC portal.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00219 Published 2025-11-20 Fixed in 4.0.8, 3.1.16 CWE-367

TI-2025-36194 CVE-2025-58435

LOW 21

Open OnDemand is an open-source HPC portal.

CVSS 4.0MEDIUM 4.1 Network Low privileges User interaction EPSS 0.0027 Published 2025-09-09 Fixed in 3.1.15, 4.0.7 CWE-262

TI-2025-33562 CVE-2025-53636

LOW 24

Open OnDemand is an open-source HPC portal.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00336 Published 2025-07-11 Fixed in 3.1.14, 4.0.6 CWE-400

TI-2020-18567 CVE-2020-36247 · GHSA-qvvw-rm7q-75fx

LOW 38

Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00449 Published 2021-02-19 No fix listed CWE-352