OneUptime OneUptime

• CVE-2026-112047 Medium 5.4 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions 0.2%
• CVE-2026-80350 High 7.1 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL 0.4%
• CVE-2026-45102 Critical 9.9 OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion 0.3%
• CVE-2026-35053 Critical 9.2 OneUptime: Unauthenticated Workflow Execution via ManualAPI 0.6%
• CVE-2026-34840 High 8.1 OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification 0.3%
• CVE-2026-34759 Critical 9.2 OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure 0.6%
• CVE-2026-34758 Critical 9.1 OneUptime: Missing Authentication on Notification Endpoints 0.4%
• CVE-2026-33396 Critical 10.0 OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe 0.8%
• CVE-2026-33142 High 8.1 OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters 0.3%
• CVE-2026-33143 High 8.7 OneUptime: WhatsApp Webhook Missing Signature Verification 0.2%
• CVE-2026-32598 Medium 6.9 OneUptime: Password Reset Token Logged at INFO Level 0.2%
• CVE-2026-32308 High 7.6 OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") 0.2%
• CVE-2026-32306 Critical 10.0 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters 0.7%
• CVE-2026-30959 Medium 5.3 OneUptime has WhatsApp Resend Verification Authorization Bypass 0.4%
• CVE-2026-30958 High 7.2 OneUptime: Path Traversal — Arbitrary File Read (No Auth) 1.2%
• CVE-2026-30957 Critical 10.0 OneUptime Synthetic Monitor RCE via exposed Playwright browser object 1.3%
• CVE-2026-30956 Critical 10.0 OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header 0.5%
• CVE-2026-30921 Critical 10.0 OneUptime Synthetic Monitor RCE via exposed Playwright browser object 0.5%
• CVE-2026-30920 High 8.6 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding 0.2%
• CVE-2026-30887 Critical 10.0 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE 0.4%
• CVE-2026-28787 High 8.2 OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay 0.3%
• CVE-2026-27728 Critical 10.0 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() 2.0%
• CVE-2026-27574 Critical 10.0 OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE 0.6%
• CVE-2025-66028 Medium 6.9 OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation 0.3%
• CVE-2025-65966 High 8.8 OneUptime Unauthorized User Creation via API 0.3%
• CVE-2024-29194 High 8.3 OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation 0.7%