Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: onesignal Clear all filters
TI-2026-02726 CVE-2026-3155 · GHSA-qw58-mhg6-q49h

Missing authorization in OneSignal – Web Push Notifications

Priority LOW 15

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-16 No fix listed CWE-862
TI-2025-12748 CVE-2025-13950 · GHSA-9jm2-ww3f-6gg3

OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update

Priority LOW 30

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00315 Published 2025-12-15 No fix listed CWE-862
TI-2023-12974 CVE-2023-28430

OneSignal repository github action command injection

Priority HIGH 70

OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed).

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00905 Published 2023-03-27 Fixed in 4.5.1 CWE-77