MAL-2025-35860 Malicious code in test-mlw2-newts-bidet (npm)

The package test-mlw2-newts-bidet was found to contain malicious code...

GHSA-C3MP-9VX3-2RVV OpenNMS Horizon RCE via JEXL2 expression

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

OpenNMS Horizon RCE via JEXL2 expression

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

CVE-2021-3396

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

Remote code execution

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

CVE-2021-3396

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts 1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions...

CVE-2021-3396

CVE-2021-3396 affects OpenNMS Meridian (2016, 2017, 2018 before 2018.1.25; 2019 before 2019.1.16; 2020 before 2020.1.5), Horizon 1.2 through 27.0.4, and Newts

PT-2021-20367

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions 2016 through 2018 before 2018.1.25 OpenNMS Meridian versions 2019 before 2019.1.16 OpenNMS Meridian versions 2020 before 2020.1.5 OpenNMS Horizon versions 1.2 through 27.0.4 OpenNMS Newts versions prior to 1.5.3...