ON
Product
oneuptime
26
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 11High 12Medium 3Low 0
Watch
Add oneuptime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45102 | 9.9 | May 27 | OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion Affected: < 10.0.98 |
| CVE-2026-33396 | 9.9 | Mar 26 | OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe Affected: < 10.0.35 |
| CVE-2026-32306 | 9.9 | Mar 12 | OneUptime ClickHouse SQL Injection via Aggregate Query Parameters Affected: < 10.0.23 |
| CVE-2026-30957 | 9.9 | Mar 10 | OneUptime Synthetic Monitor RCE via exposed Playwright browser object Affected: < 10.0.21 |
| CVE-2026-30956 | 9.9 | Mar 10 | OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header Affected: < 10.0.21 |
| CVE-2026-30921 | 9.9 | Mar 9 | OneUptime Synthetic Monitor RCE via exposed Playwright browser object Affected: < 10.0.20 |
| CVE-2026-30887 | 9.9 | Mar 9 | OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE Affected: < 10.0.18 |
| CVE-2026-27574 | 9.9 | Feb 21 | OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE Affected: < 10.0.5 |
| CVE-2026-35053 | 9.8 | Apr 2 | OneUptime: Unauthenticated Workflow Execution via ManualAPI Affected: < 10.0.42 |
| CVE-2026-34758 | 9.1 | Apr 2 | OneUptime: Missing Authentication on Notification Endpoints Affected: < 10.0.42 |
| CVE-2026-28787 | 9.0 | Mar 6 | OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay Affected: <= 10.0.11 |
Showing 11