323 matches found
CVE-2026-111252
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server...
CVE-2026-111252 OpenNMS denial of service via XML entity expansion
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server...
CVE-2026-111235
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...
CVE-2026-89089
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-19596
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
EUVD-2026-75729
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-19596
An XML External Entity (XXE) vulnerability in the XML collector of OpenNMS Meridian and Horizon allows an attacker who can control the XML response collected by OpenNMS (e.g., via a compromised monitored host or HTTP man-in-the-middle) to read files accessible to the OpenNMS service account, incl...
CVE-2026-19596 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-19596 OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
EUVD-2026-75725
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-89089: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
PT-2026-89588
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLE USER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
CVE-2026-19596: Improper Restriction of XML External Entity Reference
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
PT-2026-89577
An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...
CVE-2026-19182
An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...
EUVD-2026-57719
An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...
CVE-2026-19135
A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...
PT-2026-71387
An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLE REST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLE READONLY, to modify alarm state despite the...