OneUptime vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20252
3. 202623

Newest CVEs

• CVE-2026-112047

  OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions

  OneUptime · oneuptime

  Medium5.3
• CVE-2026-80350

  OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

  OneUptime · OneUptime

  High7.1
• CVE-2026-45102

  OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion

  OneUptime · oneuptime

  Critical9.9
• CVE-2026-35053

  OneUptime: Unauthenticated Workflow Execution via ManualAPI

  OneUptime · oneuptime

  Critical9.2
• CVE-2026-34840

  OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification

  OneUptime · oneuptime

  High8.1
• CVE-2026-34759

  OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure

  OneUptime · oneuptime

  Critical9.2
• CVE-2026-34758

  OneUptime: Missing Authentication on Notification Endpoints

  OneUptime · oneuptime

  Critical9.1
• CVE-2026-33396

  OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe

  OneUptime · oneuptime

  Critical10.0
• CVE-2026-33142

  OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

  OneUptime · oneuptime

  High8.1
• CVE-2026-33143

  OneUptime: WhatsApp Webhook Missing Signature Verification

  OneUptime · oneuptime

  High8.7