https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T18:08:26.209817+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-81679 fkie_cve-2026-81679 2026-09-29T18:08:27.452954+00:00

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.

 https://vulnerability.circl.lu/vuln/ghsa-fgj3-5frq-8vw8 GHSA-fgj3-5frq-8vw8 2026-09-29T18:08:27.453304+00:00

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.