CVE-2026-124435: openremote core: OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with…

OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image...