Ttheonedev

Products

Exploited and recent CVEs

• CVE-2026-49248 High 8.3 OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar 0.6%
• CVE-2026-11441 Medium 6.3 theonedev Pull Request issues canAccessIssue improper authorization 0.2%
• CVE-2026-11440 Medium 6.3 theonedev REST API default-branch improper authorization 0.2%
• CVE-2026-11439 Medium 6.3 theonedev Parent Project projects improper authorization 0.2%
• CVE-2026-11438 Medium 6.3 theonedev projects improper authorization 0.2%
• CVE-2026-44647 High 7.1 OneDev: Path Traversal (read capability via Git LFS pointer resolution) 0.3%
• CVE-2024-45309 High 8.7 OneDev vulnerable to arbitrary file reading for unauthenticated user 24.5%
• CVE-2023-24828 High 8.1 Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev 0.7%
• CVE-2022-39206 Critical 9.9 CI/CD Docker Escape in OneDev 2.1%
• CVE-2022-39207 Medium 5.4 Persistent XSS in OneDev 1.0%
• CVE-2022-39208 High 7.5 Git Repository Disclosure in Onedev 1.9%
• CVE-2022-39205 Critical 9.0 Access Control Bypass in Onedev 2.4%
• CVE-2021-32651 Low 3.1 LDAP injection via OneDev may leak some LDAP directory information 1.1%
• CVE-2021-21245 Critical 10.0 Pre-Auth Arbitrary File Upload 1.2%
• CVE-2021-21246 High 8.6 Pre-Auth Access token leak 49.1%
• CVE-2021-21247 Critical 9.6 Post-Auth Unsafe Deserialization on BasePage (AJAX) 1.5%
• CVE-2021-21249 Critical 9.6 Post-Auth Unsafe Yaml deserialization 3.1%
• CVE-2021-21248 Critical 9.6 Post-Auth Arbitrary Code execution via Groovy script injection 1.5%
• CVE-2021-21250 High 7.7 Post-Auth External Entity Expansion (XXE) 0.9%
• CVE-2021-21251 High 7.7 ZipSlip Arbitrary File Upload 12.7%
• CVE-2021-21242 Critical 10.0 Pre-Auth Unsafe Deserialization on AttachmentUploadServet 74.2%
• CVE-2021-21243 Critical 10.0 Pre-Auth Unsafe Deserialization on KubernetesResource 54.5%
• CVE-2021-21244 Critical 10.0 Pre-Auth SSTI via Bean validation message tampering 1.5%