ON
Product
oneuptime
26
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 11High 12Medium 3Low 0
Watch
Add oneuptime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27728 | 8.8 | Feb 25 | OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() Affected: < 10.0.7 |
| CVE-2026-30958 | 8.6 | Mar 10 | OneUptime: Path Traversal — Arbitrary File Read (No Auth) Affected: < 10.0.21 |
| CVE-2026-30920 | 8.6 | Mar 9 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding Affected: < 10.0.19 |
| CVE-2024-29194 | 8.3 | Mar 24 | OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation Affected: < 7.0.1815 |
| CVE-2025-66028 | 8.2 | Nov 26 | OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation Affected: < 8.0.5567 |
| CVE-2026-34840 | 8.1 | Apr 2 | OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification Affected: < 10.0.42 |
| CVE-2026-34759 | 8.1 | Apr 2 | OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure Affected: < 10.0.42 |
| CVE-2026-33142 | 8.1 | Mar 20 | OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters Affected: < 10.0.34 |
| CVE-2025-65966 | 8.1 | Nov 26 | OneUptime Unauthorized User Creation via API Affected: = 9.0.5598 |
| CVE-2026-32308 | 7.6 | Mar 12 | OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") Affected: < 10.0.23 |
| CVE-2026-33143 | 7.5 | Mar 20 | OneUptime: WhatsApp Webhook Missing Signature Verification Affected: < 10.0.34 |
| CVE-2026-80350 | 7.1 | Aug 26 | OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL Affected: before 12.0.7 |
Showing 12