Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@oneuptime/common

11 known vulnerabilities (6 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
14.0.105 (Nov 7, 2026): no advisory affects it
Newest unaffected release
14.0.105 (Nov 7, 2026), the latest release
Advisories
11 · 6 critical, 3 high, 2 medium
Weekly downloads
16.4K
Releases
500+ since 8.0.5488 (Oct 29, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 11

  • CVE-2026-30959Medium 5.3

    OneUptime has WhatsApp Resend Verification Authorization Bypass

    Affected: fixed in 10.0.21.

    Fixed in 10.0.21 (released Mar 7, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    83% of @oneuptime/common downloads last week were affected versions (13.9K).

  • CVE-2026-30957Critical 10.0

    OneUptime Synthetic Monitor RCE via exposed Playwright browser object

    Affected: fixed in 10.0.21.

    Fixed in 10.0.21 (released Mar 7, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    83% of @oneuptime/common downloads last week were affected versions (13.9K).

  • CVE-2026-30956Critical 10.0

    OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

    Affected: fixed in 10.0.21.

    Fixed in 10.0.21 (released Mar 7, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    83% of @oneuptime/common downloads last week were affected versions (13.9K).

  • CVE-2026-30921Critical 10.0

    OneUptime Synthetic Monitor RCE via exposed Playwright browser object

    Affected: fixed in 10.0.20.

    Fixed in 10.0.20 (released Mar 6, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    82% of @oneuptime/common downloads last week were affected versions (13.9K).

  • OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

    Affected: fixed in 10.0.19.

    Fixed in 10.0.19 (released Mar 6, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    82% of @oneuptime/common downloads last week were affected versions (13.9K).

  • CVE-2026-30887Critical 10.0

    OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

    Affected: fixed in 10.0.18.

    Fixed in 10.0.18 (released Mar 4, 2026, 5 days before disclosure).

    The latest release, 14.0.105, is not affected.

    82% of @oneuptime/common downloads last week were affected versions (13.9K).

  • OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

    Affected: through 10.0.11.

    Fixed in 10.0.14 (released Feb 26, 2026, 8 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 14.0.105, is not affected.

    82% of @oneuptime/common downloads last week were affected versions (13.8K).

  • CVE-2026-27728Critical 10.0

    OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

    Affected: fixed in 10.0.7.

    Fixed in 10.0.7 (released Feb 22, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    82% of @oneuptime/common downloads last week were affected versions (13.8K).

  • CVE-2026-27574Critical 10.0

    OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

    Affected: fixed in 10.0.0.

    Fixed in 10.0.0 (released Feb 18, 2026, 3 days before disclosure).

    The latest release, 14.0.105, is not affected.

    81% of @oneuptime/common downloads last week were affected versions (13.7K).

  • CVE-2025-66028Medium 6.9

    OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

    Affected: fixed in 8.0.5567.

    Fixed in 8.0.5567 (released Nov 7, 2025, 19 days before disclosure).

    The latest release, 14.0.105, is not affected.

    78% of @oneuptime/common downloads last week were affected versions (13.1K).

  • OneUptime Unauthorized User Creation via API

    Affected: fixed in 9.1.0.

    Fixed in 9.1.0 (released Nov 24, 2025, 2 days before disclosure).

    The latest release, 14.0.105, is not affected.

    79% of @oneuptime/common downloads last week were affected versions (13.3K).