OneSignal
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| OneSignal – Web Push Notifications | 2 | – | Apr 16, 2026 |
| react-native-onesignal | 1 | – | Mar 27, 2023 |
Exploited and recent CVEs
- CVE-2026-3155 OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id' 0.3%
- CVE-2025-13950 OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update 0.3%
- CVE-2023-28430 OneSignal repository github action command injection 0.9%