Osc Ondemand vulnerabilities

• osc ondemand Open OnDemand: Specially crafted filenames can execute javascript in the file browser CVE-2026-44371 5.3 MediumMay 14, 2026
• osc ondemand, open ondemand +1 more OnDemand susceptible to malicious input when navigating to a directory. CVE-2026-26002 6.3 MediumMarch 4, 2026
• osc ondemand, open ondemand +1 more Open OnDemand affected by Apache proxy passing sensitive headers CVE-2025-66029 7.6 HighDecember 17, 2025
• osc ondemand Open OnDemand RPM packages create world writable locations CVE-2025-64185 6.9 MediumNovember 20, 2025
• osc ondemand Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU) CVE-2025-62724 4.3 MediumNovember 20, 2025
• osc ondemand Open OnDemand didn't rotate password for VNC batch_connect CVE-2025-58435 4.1 MediumSeptember 9, 2025
• osc ondemand Open OnDemand Shell App closed websocket DoS CVE-2025-53636 5.4 MediumJuly 11, 2025
• osc open ondemand Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF. CVE-2020-36247 8.8 HighFebruary 19, 2021