Vulnerabilities

Filters

1 selected

26 records

Sort

Vendor: OneUptime Clear all filters

TI-2026-76175 CVE-2026-112047 · GHSA-j2m9-x4vf-qv28

Incorrect authorization in OneUptime Kubernetes AI actions

LOW 23

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00177 Published 2026-10-18 Fixed in 14.0.69 CWE-863

TI-2026-55488 CVE-2026-80350 · GHSA-7f26-9454-6r96

OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

MEDIUM 64

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00401 Published 2026-08-26 Fixed in 12.0.7 CWE-918

TI-2026-32941 CVE-2026-45102

OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion

HIGH 76

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00266 Published 2026-05-27 Fixed in 10.0.98 CWE-693

TI-2026-27256 CVE-2026-35053

OneUptime: Unauthenticated Workflow Execution via ManualAPI

MEDIUM 42

OneUptime is an open-source monitoring and observability platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00556 Published 2026-04-02 Fixed in 10.0.42 CWE-306

TI-2026-27084 CVE-2026-34840

OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification

HIGH 70

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00269 Published 2026-04-02 Fixed in 10.0.42 CWE-347

TI-2026-27003 CVE-2026-34759

Missing authorization in oneuptime

MEDIUM 43

OneUptime is an open-source monitoring and observability platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00611 Published 2026-04-02 Fixed in 10.0.42 CWE-862

TI-2026-27002 CVE-2026-34758

OneUptime: Missing Authentication on Notification Endpoints

HIGH 80

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00354 Published 2026-04-02 Fixed in 10.0.42 CWE-306

TI-2026-25793 CVE-2026-33396

Protection mechanism failure in oneuptime

HIGH 76

OneUptime is an open-source monitoring and observability platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00847 Published 2026-03-26 Fixed in 10.0.35 CWE-184

TI-2026-25572 CVE-2026-33142 · GHSA-gcg3-c5p2-cqgg

OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

LOW 35

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00313 Published 2026-03-20 Fixed in 10.0.34 CWE-89

TI-2026-25573 CVE-2026-33143 · GHSA-g5ph-f57v-mwjc

OneUptime: WhatsApp Webhook Missing Signature Verification

HIGH 77

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0019 Published 2026-03-20 Fixed in 10.0.34 CWE-345

TI-2026-25108 CVE-2026-32598 · GHSA-4524-cj9j-g4fj

OneUptime: Password Reset Token Logged at INFO Level

HIGH 72

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00267 Published 2026-03-12 Fixed in 10.0.24, 10.0.23 CWE-532

TI-2026-24836 CVE-2026-32308 · GHSA-wvh5-6vjm-23qh

OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

HIGH 66

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00263 Published 2026-03-12 Fixed in 10.0.23 CWE-79

TI-2026-24835 CVE-2026-32306 · GHSA-p5g2-jm85-8g35

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00743 Published 2026-03-12 Fixed in 10.0.23 CWE-89

TI-2026-23784 CVE-2026-30959 · GHSA-cw6x-mw64-q6pv

OneUptime has WhatsApp Resend Verification Authorization Bypass

LOW 30

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00418 Published 2026-03-10 Fixed in 10.0.21 CWE-285

TI-2026-23783 CVE-2026-30958

OneUptime: Path Traversal — Arbitrary File Read (No Auth)

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01245 Published 2026-03-10 Fixed in 10.0.21 CWE-22

TI-2026-23782 CVE-2026-30957 · GHSA-jw8q-gjvg-8w4q

OneUptime Synthetic Monitor RCE via exposed Playwright browser object

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01298 Published 2026-03-10 Fixed in 10.0.21 CWE-749

TI-2026-23781 CVE-2026-30956 · GHSA-r5v6-2599-9g3m

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

MEDIUM 44

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00545 Published 2026-03-10 Fixed in 10.0.21 CWE-285

TI-2026-23746 CVE-2026-30921 · GHSA-4j36-39gm-8vq8

OneUptime Synthetic Monitor RCE via exposed Playwright browser object

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0049 Published 2026-03-09 Fixed in 10.0.20 CWE-749

TI-2026-23745 CVE-2026-30920 · GHSA-656w-6f6c-m9r6

OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0023 Published 2026-03-09 Fixed in 10.0.19 CWE-345

TI-2026-23716 CVE-2026-30887 · GHSA-h343-gg57-2q67

OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0045 Published 2026-03-09 Fixed in 10.0.18 CWE-94

TI-2026-22982 CVE-2026-28787 · GHSA-gjjc-pcwp-c74m

Improper authentication in oneuptime

HIGH 74

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00314 Published 2026-03-06 No fix listed CWE-287

TI-2026-22090 CVE-2026-27728 · GHSA-jmhp-5558-qxh5

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

HIGH 82

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.01966 Published 2026-02-25 Fixed in 10.0.7 CWE-78

TI-2026-21966 CVE-2026-27574 · GHSA-v264-xqh4-9xmm

OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

HIGH 76

OneUptime is a solution for monitoring and managing online services.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00561 Published 2026-02-21 Fixed in 10.0.5, 10.0.0 CWE-94

TI-2025-40554 CVE-2025-66028 · GHSA-675q-66gf-gqg8

OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

HIGH 70

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00324 Published 2025-11-26 Fixed in 8.0.5567 CWE-284

TI-2025-40534 CVE-2025-65966 · GHSA-m449-vh5f-574g

OneUptime Unauthorized User Creation via API

HIGH 77

OneUptime is a solution for monitoring and managing online services.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0033 Published 2025-11-26 Fixed in 9.1.0 CWE-285