theonedev vulnerabilities

CVEs per yearBy the year they were published

1. 202111
2. 20224
3. 20231
4. 20241
5. 20266

Newest CVEs

• CVE-2026-49248

  OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar

  theonedev · onedev

  High8.3
• CVE-2026-11441

  theonedev Pull Request issues canAccessIssue improper authorization

  theonedev · onedev

  Medium5.3
• CVE-2026-11440

  theonedev REST API default-branch improper authorization

  theonedev · onedev

  Medium5.3
• CVE-2026-11439

  theonedev Parent Project projects improper authorization

  theonedev · onedev

  Medium5.3
• CVE-2026-11438

  theonedev projects improper authorization

  theonedev · onedev

  Medium5.3
• CVE-2026-44647

  OneDev: Path Traversal (read capability via Git LFS pointer resolution)

  theonedev · onedev

  High7.1
• CVE-2024-45309

  OneDev vulnerable to arbitrary file reading for unauthenticated user

  theonedev · onedev

  High8.7
• CVE-2023-24828

  Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

  theonedev · onedev

  High8.1
• CVE-2022-39206

  CI/CD Docker Escape in OneDev

  theonedev · onedev

  Critical9.9
• CVE-2022-39207

  Persistent XSS in OneDev

  theonedev · onedev

  Medium5.4