OneSignal OneSignal – Web Push Notifications

• CVE-2026-3155 Low 3.1 OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id' 0.3%
• CVE-2025-13950 Medium 5.3 OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update 0.3%