TO
Vendor security profile
The OpenNMS Group
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical1
CISA KEV0
Public exploit0
Patch rate%86
Avg. CVSS6.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
3
2
CVE KEV
CVE severity distribution
7toplam CVE
Critical1 (14%)
High1 (14%)
Medium5 (71%)
Patch and exploitation view
%86
Verified patch
%0
CISA KEV
%0
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
6.5
CVE-2026-111252
OpenNMS denial of service via XML entity expansion
TO
Patch verified
9.1
CVE-2026-111235
OpenNMS REST authorization bypass via non-canonical HTTP method
TO
Patch verified
6.5
CVE-2026-89089
OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
TO
Patch verifiedEPSS %0
5.9
CVE-2026-19596
OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
TO
Patch verifiedEPSS %0
8.2
CVE-2026-89054
OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
TO
Patch verifiedEPSS %1
4.3
CVE-2026-19182
OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-only
TO
Patch verifiedEPSS %0
5.4
CVE-2026-19135
OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes
TO
Patch status unknownEPSS %0