What’s Vulnerable › Products

OneSignal – Web Push Notifications vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your OneSignal – Web Push Notifications version is affected

Latest OneSignal – Web Push Notifications vulnerabilities

• CVE-2026-3155 — OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id' (CVSS 3.1)
• CVE-2025-13950 — OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 5.3)