A critical vulnerability exists in OpenNMS Meridian and Horizon, allowing unauthorized access to the REST API via non-canonical HTTP methods. This issue enables remote attackers to read inventory data and create, modify, or delete resources without authentication. The vulnerability affects multiple versions of OpenNMS Meridian and Horizon, and administrators should assess exposure and prioritize upgrading [truncated]
A SQL injection vulnerability exists in OpenNMS Meridian and Horizon, allowing low-privileged authenticated users to execute arbitrary SQL queries and read sensitive data. The vulnerability is located in the JasperReports-based reporting feature and can be exploited via the reporting REST API. This could lead to unauthorized access to sensitive information, including database-stored secrets such as provis [truncated]
An XML External Entity (XXE) vulnerability exists in OpenNMS Meridian and Horizon. When OpenNMS collects XML from an attacker-controlled source, the collector's XML parser resolves external entities and external DTDs, allowing an attacker to read files accessible to the OpenNMS service account and induce out-of-band requests. The vulnerability can be mitigated by upgrading to patched versions and restrict [truncated]
CVE-2026-19182 is an incorrect authorization check in OpenNMS Meridian and Horizon that allows low-privileged authenticated users to modify alarm state. This could potentially compromise the integrity of alarm state and audit records. The vulnerability affects OpenNMS Meridian and Horizon deployments, and defenders should assess exposure and prioritize upgrades to prevent potential alarm state tampering. [truncated]
A low-privileged authenticated user can submit a crafted JEXL expression to the Measurements REST API in OpenNMS Meridian and Horizon, potentially allowing access to confidential information and compromising integrity. The vulnerability allows a low-privileged authenticated user to escape the sandbox and load arbitrary Java classes on the server. Defenders should assess exposure and prioritize upgrades to [truncated]
