ON
Product
oneuptime
26
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 11High 12Medium 3Low 0
Watch
Add oneuptime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45102 | 9.9 | May 27 | OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion Affected: < 10.0.98 |
| CVE-2026-33396 | 9.9 | Mar 26 | OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe Affected: < 10.0.35 |
| CVE-2026-32306 | 9.9 | Mar 12 | OneUptime ClickHouse SQL Injection via Aggregate Query Parameters Affected: < 10.0.23 |
| CVE-2026-30957 | 9.9 | Mar 10 | OneUptime Synthetic Monitor RCE via exposed Playwright browser object Affected: < 10.0.21 |
| CVE-2026-30956 | 9.9 | Mar 10 | OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header Affected: < 10.0.21 |
| CVE-2026-30921 | 9.9 | Mar 9 | OneUptime Synthetic Monitor RCE via exposed Playwright browser object Affected: < 10.0.20 |
| CVE-2026-30887 | 9.9 | Mar 9 | OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE Affected: < 10.0.18 |
| CVE-2026-27574 | 9.9 | Feb 21 | OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE Affected: < 10.0.5 |
| CVE-2026-35053 | 9.8 | Apr 2 | OneUptime: Unauthenticated Workflow Execution via ManualAPI Affected: < 10.0.42 |
| CVE-2026-34758 | 9.1 | Apr 2 | OneUptime: Missing Authentication on Notification Endpoints Affected: < 10.0.42 |
| CVE-2026-28787 | 9.0 | Mar 6 | OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay Affected: <= 10.0.11 |
| CVE-2026-27728 | 8.8 | Feb 25 | OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() Affected: < 10.0.7 |
| CVE-2026-30958 | 8.6 | Mar 10 | OneUptime: Path Traversal — Arbitrary File Read (No Auth) Affected: < 10.0.21 |
| CVE-2026-30920 | 8.6 | Mar 9 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding Affected: < 10.0.19 |
| CVE-2024-29194 | 8.3 | Mar 24 | OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation Affected: < 7.0.1815 |
| CVE-2025-66028 | 8.2 | Nov 26 | OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation Affected: < 8.0.5567 |
| CVE-2026-34840 | 8.1 | Apr 2 | OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification Affected: < 10.0.42 |
| CVE-2026-34759 | 8.1 | Apr 2 | OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure Affected: < 10.0.42 |
| CVE-2026-33142 | 8.1 | Mar 20 | OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters Affected: < 10.0.34 |
| CVE-2025-65966 | 8.1 | Nov 26 | OneUptime Unauthorized User Creation via API Affected: = 9.0.5598 |
| CVE-2026-32308 | 7.6 | Mar 12 | OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") Affected: < 10.0.23 |
| CVE-2026-33143 | 7.5 | Mar 20 | OneUptime: WhatsApp Webhook Missing Signature Verification Affected: < 10.0.34 |
| CVE-2026-80350 | 7.1 | Aug 26 | OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL Affected: before 12.0.7 |
| CVE-2026-32598 | 6.5 | Mar 12 | OneUptime: Password Reset Token Logged at INFO Level Affected: < 10.0.24 |
| CVE-2026-112047 | 5.4 | Oct 18 | OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions Affected: 14.0.2 before 14.0.69 |
| CVE-2026-30959 | 5.0 | Mar 10 | OneUptime has WhatsApp Resend Verification Authorization Bypass Affected: < 10.0.21 |
Showing 26