ME
Product
Meridian
21
CVEs
0
On KEV
9.1
Max CVSS
2
New 30D
Severity mix
Critical 1High 4Medium 16Low 0
Watch
Add Meridian to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111235 | 9.1 | Oct 15 | OpenNMS REST authorization bypass via non-canonical HTTP method Affected: 2024.1.0 before 2024.3.14; 2025.0.0 before 2025.0.11; 2026.0.0 before 2026.0.1 |
| CVE-2023-40313 | 8.8 | Aug 17 | Disable BeanShell Interpreter Remote Server Mode Affected: 2020.0.0 through 2020.1.37; 2021.0.0 through 2021.1.29; 2022.0.0 through 2022.1.18; 2023.0.0 through 2023.1.5 |
| CVE-2023-40612 | 8.0 | Aug 23 | Authenticated XXE Injection Via The File Editor Affected: 2023.0.0 before 2023.1.5 |
| CVE-2023-40315 | 8.0 | Aug 17 | ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN Affected: 2023.0.0 before 2023.1.5 |
| CVE-2023-0872 | 8.0 | Aug 14 | ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users Affected: 2020.0.0 through 2020.1.37; 2021.0.0 through 2021.1.29; 2022.0.0 through 2022.1.18; 2023.0.0 through 2023.1.5 |
| CVE-2025-53122 | 6.9 | Jun 26 | SQLi in OpenNMS Horizon and Meridian Affected: 2024.1.0 before 2024.2.6, 2024.2.7 |
| CVE-2025-53121 | 6.9 | Jun 26 | Stored XSS in multiple 33.0.8files in opennms/opennms Affected: 2024.1.4 before 2024.2.6, 2024.2.7; 2023.1.20 before 2024.2.6, 2024.2.7 |
| CVE-2023-0870 | 6.7 | Mar 22 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) Affected: 2020.1.0 before 2020.1.33; 2021.1.0 before 2021.1.25; 2022.1.0 before 2022.1.14; 2023.1.0 before 2023.1.1 |
| CVE-2026-111252 | 6.5 | Oct 15 | OpenNMS denial of service via XML entity expansion Affected: 2024.1.0 before 2024.3.14; 2025.0.0 before 2025.0.11; 2026.0.0 before 2026.0.1 |
| CVE-2026-89089 | 6.5 | Sep 10 | OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) Affected: 2024.1.0 before 2024.3.13; 2025.0.0 before 2025.0.10 |
| CVE-2023-0815 | 6.5 | Feb 23 | Plaintext Password Present in the Web logs Affected: 2020.1.0 before 2020.1.32; 2021.1.0 before 2021.1.24; 2022.1.0 before 2022.1.13 |
| CVE-2023-0871 | 6.1 | Aug 11 | An XML External Entity injection vulnerability Affected: 2023.0.0 before 2023.1.6; 2022.0.0 before 2022.1.19; 2021.0.0 before 2021.1.30; 2020.0.0 before 2020.1.38 |
| CVE-2023-0867 | 6.1 | Feb 23 | Multiple stored and reflected Cross-site Scripting in webapp Affected: 2020.1.0 before 2020.1.32; 2021.1.0 before 2021.1.24; 2022.1.0 before 2022.1.13 |
| CVE-2023-0868 | 6.1 | Feb 23 | Stealing Cookies using Reflected XSS via graph results Affected: 2022.1.0 before 2023.1.0 |
| CVE-2023-0869 | 6.1 | Feb 23 | Cross-site scripting in outage/list.htm Affected: 2022.1.0 before 2023.1.0 |
| CVE-2023-0846 | 6.1 | Feb 22 | Unauthenticated, stored XSS in display of alarm reduction-key Affected: 2020.1.0 before 2020.1.32; 2021.1.0 before 2021.1.24; 2022.1.0 before 2022.1.13 |
| CVE-2026-19596 | 5.9 | Sep 10 | OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host Affected: 2024.1.0 before 2024.3.13; 2025.0.0 before 2025.0.10 |
| CVE-2026-19135 | 5.4 | Aug 13 | OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes Affected: 2024.1.0 before 2024.3.12; 2025.0.0 before 2025.0.9 |
| CVE-2023-40312 | 5.2 | Aug 14 | Reflected XSS in multiple JSP files in opennms/opennms Affected: 2020.0.0 through 2020.1.37; 2021.0.0 through 2021.1.29; 2022.0.0 through 2022.1.18; 2023.0.0 through 2023.1.5 |
| CVE-2023-40311 | 4.8 | Aug 14 | Stored XSS in multiple JSP files in opennms/opennms Affected: 2020.0.0 through 2020.1.37; 2021.0.0 through 2021.1.29; 2022.0.0 through 2022.1.18; 2023.0.0 through 2023.1.5 |
| CVE-2026-19182 | 4.3 | Aug 13 | OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only Affected: 2024.1.0 before 2024.3.12; 2025.0.0 before 2025.0.9 |
Showing 21