# @oneuptime/common (npm) vulnerabilities 11 known vulnerabilities (6 critical, 3 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 14.0.105 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 14.0.105 (Nov 7, 2026), the latest release - Weekly downloads: 16.4K - Releases: 500+ since 8.0.5488 (Oct 29, 2025) - Registry: https://www.npmjs.com/package/@oneuptime/common - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-30959: 8.0.5488 to 10.0.20 (10.0.21 is outside it) - CVE-2026-30957: 8.0.5488 to 10.0.20 (10.0.21 is outside it) - CVE-2026-30956: 8.0.5488 to 10.0.20 (10.0.21 is outside it) - CVE-2026-30921: 8.0.5488 to 10.0.19 (10.0.20 is outside it) - CVE-2026-30920: 8.0.5488 to 10.0.18 (10.0.19 is outside it) - CVE-2026-30887: 8.0.5488 to 10.0.17 (10.0.18 is outside it) - CVE-2026-28787: 8.0.5488 to 10.0.11 (10.0.14 is outside it) - CVE-2026-27728: 8.0.5488 to 10.0.6 (10.0.7 is outside it) - CVE-2026-27574: 8.0.5488 to 9.5.13 (10.0.0 is outside it) - CVE-2025-66028: 8.0.5488 to 8.0.5566 (8.0.5567 is outside it) - CVE-2025-65966: 8.0.5488 to 9.0.5598 (9.1.0 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (11) ### [CVE-2026-30959](https://cve.now/CVE-2026-30959): OneUptime has WhatsApp Resend Verification Authorization Bypass - Severity: Medium 5.3 - Published: Mar 10, 2026 - Affected: fixed in 10.0.21. - Fixed in 10.0.21 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 83% of @oneuptime/common downloads last week were affected versions (13.9K). ### [CVE-2026-30957](https://cve.now/CVE-2026-30957): OneUptime Synthetic Monitor RCE via exposed Playwright browser object - Severity: Critical 10.0 - Published: Mar 10, 2026 - Affected: fixed in 10.0.21. - Fixed in 10.0.21 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 83% of @oneuptime/common downloads last week were affected versions (13.9K). ### [CVE-2026-30956](https://cve.now/CVE-2026-30956): OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header - Severity: Critical 10.0 - Published: Mar 10, 2026 - Affected: fixed in 10.0.21. - Fixed in 10.0.21 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 83% of @oneuptime/common downloads last week were affected versions (13.9K). ### [CVE-2026-30921](https://cve.now/CVE-2026-30921): OneUptime Synthetic Monitor RCE via exposed Playwright browser object - Severity: Critical 10.0 - Published: Mar 9, 2026 - Affected: fixed in 10.0.20. - Fixed in 10.0.20 (released Mar 6, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 82% of @oneuptime/common downloads last week were affected versions (13.9K). ### [CVE-2026-30920](https://cve.now/CVE-2026-30920): OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding - Severity: High 8.6 - Published: Mar 9, 2026 - Affected: fixed in 10.0.19. - Fixed in 10.0.19 (released Mar 6, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 82% of @oneuptime/common downloads last week were affected versions (13.9K). ### [CVE-2026-30887](https://cve.now/CVE-2026-30887): OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE - Severity: Critical 10.0 - Published: Mar 9, 2026 - Affected: fixed in 10.0.18. - Fixed in 10.0.18 (released Mar 4, 2026, 5 days before disclosure). - The latest release, 14.0.105, is not affected. - 82% of @oneuptime/common downloads last week were affected versions (13.9K). ### [CVE-2026-28787](https://cve.now/CVE-2026-28787): OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay - Severity: High 8.2 - Published: Mar 6, 2026 - Affected: through 10.0.11. - Fixed in 10.0.14 (released Feb 26, 2026, 8 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 14.0.105, is not affected. - 82% of @oneuptime/common downloads last week were affected versions (13.8K). ### [CVE-2026-27728](https://cve.now/CVE-2026-27728): OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - Severity: Critical 10.0 - Published: Feb 25, 2026 - Affected: fixed in 10.0.7. - Fixed in 10.0.7 (released Feb 22, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 82% of @oneuptime/common downloads last week were affected versions (13.8K). ### [CVE-2026-27574](https://cve.now/CVE-2026-27574): OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE - Severity: Critical 10.0 - Published: Feb 21, 2026 - Affected: fixed in 10.0.0. - Fixed in 10.0.0 (released Feb 18, 2026, 3 days before disclosure). - The latest release, 14.0.105, is not affected. - 81% of @oneuptime/common downloads last week were affected versions (13.7K). ### [CVE-2025-66028](https://cve.now/CVE-2025-66028): OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation - Severity: Medium 6.9 - Published: Nov 26, 2025 - Affected: fixed in 8.0.5567. - Fixed in 8.0.5567 (released Nov 7, 2025, 19 days before disclosure). - The latest release, 14.0.105, is not affected. - 78% of @oneuptime/common downloads last week were affected versions (13.1K). ### [CVE-2025-65966](https://cve.now/CVE-2025-65966): OneUptime Unauthorized User Creation via API - Severity: High 8.8 - Published: Nov 26, 2025 - Affected: fixed in 9.1.0. - Fixed in 9.1.0 (released Nov 24, 2025, 2 days before disclosure). - The latest release, 14.0.105, is not affected. - 79% of @oneuptime/common downloads last week were affected versions (13.3K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@oneuptime/common Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.