What’s Vulnerable › Products

oneuptime vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.

Check whether your oneuptime version is affected

Latest oneuptime vulnerabilities

• CVE-2026-112047 — OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions (CVSS 5.4)
• CVE-2026-80350 — OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL (CVSS 7.1)
• CVE-2026-45102 — OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion (CVSS 9.9)
• CVE-2026-35053 — OneUptime: Unauthenticated Workflow Execution via ManualAPI (CVSS 9.8)
• CVE-2026-34840 — OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification (CVSS 8.1)
• CVE-2026-34759 — OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure (CVSS 8.1)
• CVE-2026-34758 — OneUptime: Missing Authentication on Notification Endpoints (CVSS 9.1)
• CVE-2026-33396 — OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe (CVSS 9.9)
• CVE-2026-33143 — OneUptime: WhatsApp Webhook Missing Signature Verification (CVSS 7.5)
• CVE-2026-33142 — OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters (CVSS 8.1)
• CVE-2026-32598 — OneUptime: Password Reset Token Logged at INFO Level (CVSS 6.5)
• CVE-2026-32308 — OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") (CVSS 7.6)
• CVE-2026-32306 — OneUptime ClickHouse SQL Injection via Aggregate Query Parameters (CVSS 9.9)
• CVE-2026-30959 — OneUptime has WhatsApp Resend Verification Authorization Bypass (CVSS 5.0)
• CVE-2026-30958 — OneUptime: Path Traversal — Arbitrary File Read (No Auth) (CVSS 8.6)
• CVE-2026-30957 — OneUptime Synthetic Monitor RCE via exposed Playwright browser object (CVSS 9.9)
• CVE-2026-30956 — OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header (CVSS 9.9)
• CVE-2026-30921 — OneUptime Synthetic Monitor RCE via exposed Playwright browser object (CVSS 9.9)
• CVE-2026-30920 — OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding (CVSS 8.6)
• CVE-2026-30887 — OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE (CVSS 9.9)
• CVE-2026-28787 — OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay (CVSS 9.0)
• CVE-2026-27728 — OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() (CVSS 8.8)
• CVE-2026-27574 — OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE (CVSS 9.9)
• CVE-2025-66028 — OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation (CVSS 8.2)
• CVE-2025-65966 — OneUptime Unauthorized User Creation via API (CVSS 8.1)