Product by The Opennms Group
Horizon
23 known vulnerabilities in Horizon (The Opennms Group), 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-0872 | ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users | 8.2 | |
| High | CVE-2023-40315 | ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN | 5.3 | |
| Critical | CVE-2026-111235 | OpenNMS REST authorization bypass via non-canonical HTTP method | 9.1 | |
| High | CVE-2026-89054 | The OpenNMS Group Horizon: Missing Authorization | 8.2 | |
| Medium | CVE-2026-89089 | The OpenNMS Group Meridian: SQL Injection | 6.5 | |
| Medium | CVE-2026-111252 | OpenNMS denial of service via XML entity expansion | 6.5 | |
| High | CVE-2023-40313 | Disable BeanShell Interpreter Remote Server Mode | 7.1 | |
| Medium | CVE-2026-19596 | OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host | 5.9 | |
| Medium | CVE-2023-40311 | Stored XSS in multiple JSP files in opennms/opennms | 6.7 | |
| Medium | CVE-2023-40312 | Reflected XSS in multiple JSP files in opennms/opennms | 6.7 | |
| Medium | CVE-2023-0815 | Plaintext Password Present in the Web logs | 6.8 | |
| Medium | CVE-2026-19135 | OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes | 5.4 | |
| Medium | CVE-2023-0846 | Unauthenticated, stored XSS in display of alarm reduction-key | 6.7 | |
| Medium | CVE-2023-0868 | Stealing Cookies using Reflected XSS via graph results | 6.7 | |
| High | CVE-2023-0870 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) | 8.1 | |
| Medium | CVE-2023-0871 | An XML External Entity injection vulnerability | 5.4 | |
| Medium | CVE-2026-19182 | The OpenNMS Group Meridian: Incorrect Authorization | 4.3 | |
| Medium | CVE-2023-0867 | Multiple stored and reflected Cross-site Scripting in webapp | 6.7 | |
| Medium | CVE-2025-53121 | Stored XSS in multiple 33.0.8files in opennms/opennms | — | |
| Medium | CVE-2025-53122 | SQLi in OpenNMS Horizon and Meridian | — | |
| Medium | CVE-2023-40314 | Cross-site scripting in bootstrap.jsp | 5.8 | |
| Medium | CVE-2023-0869 | Cross-site scripting in outage/list.htm | 5.8 | |
| High | CVE-2023-40612 | Authenticated XXE Injection Via The File Editor | 5.3 |