Vulnerabilities

Filters

2 selected

23 records

Sort

Vendor: OneUptime Component: Oneuptime Clear all filters

TI-2026-27256 CVE-2026-35053

OneUptime: Unauthenticated Workflow Execution via ManualAPI

MEDIUM 42

OneUptime is an open-source monitoring and observability platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00556 Published 2026-04-02 Fixed in 10.0.42 CWE-306

TI-2026-27084 CVE-2026-34840

OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification

HIGH 70

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00269 Published 2026-04-02 Fixed in 10.0.42 CWE-347

TI-2026-27003 CVE-2026-34759

Missing authorization in oneuptime

MEDIUM 43

OneUptime is an open-source monitoring and observability platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00611 Published 2026-04-02 Fixed in 10.0.42 CWE-862

TI-2026-27002 CVE-2026-34758

OneUptime: Missing Authentication on Notification Endpoints

HIGH 80

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00354 Published 2026-04-02 Fixed in 10.0.42 CWE-306

TI-2026-25793 CVE-2026-33396

Protection mechanism failure in oneuptime

HIGH 76

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00847 Published 2026-03-26 Fixed in 10.0.35 CWE-184

TI-2026-25572 CVE-2026-33142 · GHSA-gcg3-c5p2-cqgg

OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

LOW 35

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00313 Published 2026-03-20 Fixed in 10.0.34 CWE-89

TI-2026-25573 CVE-2026-33143 · GHSA-g5ph-f57v-mwjc

OneUptime: WhatsApp Webhook Missing Signature Verification

HIGH 77

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0019 Published 2026-03-20 Fixed in 10.0.34 CWE-345

TI-2026-25108 CVE-2026-32598 · GHSA-4524-cj9j-g4fj

OneUptime: Password Reset Token Logged at INFO Level

HIGH 72

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00267 Published 2026-03-12 Fixed in 10.0.24, 10.0.23 CWE-532

TI-2026-24836 CVE-2026-32308 · GHSA-wvh5-6vjm-23qh

OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

HIGH 66

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00263 Published 2026-03-12 Fixed in 10.0.23 CWE-79

TI-2026-24835 CVE-2026-32306 · GHSA-p5g2-jm85-8g35

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00743 Published 2026-03-12 Fixed in 10.0.23 CWE-89

TI-2026-23784 CVE-2026-30959 · GHSA-cw6x-mw64-q6pv

OneUptime has WhatsApp Resend Verification Authorization Bypass

LOW 30

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00418 Published 2026-03-10 Fixed in 10.0.21 CWE-285

TI-2026-23783 CVE-2026-30958

OneUptime: Path Traversal — Arbitrary File Read (No Auth)

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01245 Published 2026-03-10 Fixed in 10.0.21 CWE-22

TI-2026-23782 CVE-2026-30957 · GHSA-jw8q-gjvg-8w4q

OneUptime Synthetic Monitor RCE via exposed Playwright browser object

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01298 Published 2026-03-10 Fixed in 10.0.21 CWE-749

TI-2026-23781 CVE-2026-30956 · GHSA-r5v6-2599-9g3m

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

MEDIUM 44

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00545 Published 2026-03-10 Fixed in 10.0.21 CWE-285

TI-2026-23746 CVE-2026-30921 · GHSA-4j36-39gm-8vq8

OneUptime Synthetic Monitor RCE via exposed Playwright browser object

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0049 Published 2026-03-09 Fixed in 10.0.20 CWE-749

TI-2026-23745 CVE-2026-30920 · GHSA-656w-6f6c-m9r6

OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0023 Published 2026-03-09 Fixed in 10.0.19 CWE-345

TI-2026-23716 CVE-2026-30887 · GHSA-h343-gg57-2q67

OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0045 Published 2026-03-09 Fixed in 10.0.18 CWE-94

TI-2026-22982 CVE-2026-28787 · GHSA-gjjc-pcwp-c74m

Improper authentication in oneuptime

HIGH 74

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00314 Published 2026-03-06 No fix listed CWE-287

TI-2026-22090 CVE-2026-27728 · GHSA-jmhp-5558-qxh5

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

HIGH 82

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01966 Published 2026-02-25 Fixed in 10.0.7 CWE-78

TI-2026-21966 CVE-2026-27574 · GHSA-v264-xqh4-9xmm

OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00561 Published 2026-02-21 Fixed in 10.0.5, 10.0.0 CWE-94

TI-2025-40554 CVE-2025-66028 · GHSA-675q-66gf-gqg8

OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

HIGH 70

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00324 Published 2025-11-26 Fixed in 8.0.5567 CWE-284

TI-2025-40534 CVE-2025-65966 · GHSA-m449-vh5f-574g

OneUptime Unauthorized User Creation via API

HIGH 77

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0033 Published 2025-11-26 Fixed in 9.1.0 CWE-285

TI-2024-19363 CVE-2024-29194 · GHSA-246p-xmg8-wmcq

OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation

HIGH 71

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00702 Published 2024-03-24 Fixed in 7.0.1815 CWE-639