# cve.now: Oneuptime

The newest entries naming Oneuptime as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-112047](https://cve.now/CVE-2026-112047.md): OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions (CVSS 5.3)
- [CVE-2026-80350](https://cve.now/CVE-2026-80350.md): OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL (CVSS 7.1)
- [CVE-2026-45102](https://cve.now/CVE-2026-45102.md): OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion (CVSS 9.9)
- [CVE-2026-35053](https://cve.now/CVE-2026-35053.md): OneUptime: Unauthenticated Workflow Execution via ManualAPI (CVSS 9.2)
- [CVE-2026-34840](https://cve.now/CVE-2026-34840.md): OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification (CVSS 8.1)
- [CVE-2026-34759](https://cve.now/CVE-2026-34759.md): OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure (CVSS 9.2)
- [CVE-2026-34758](https://cve.now/CVE-2026-34758.md): OneUptime: Missing Authentication on Notification Endpoints (CVSS 9.1)
- [CVE-2026-33396](https://cve.now/CVE-2026-33396.md): OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe (CVSS 10.0)
- [CVE-2026-33142](https://cve.now/CVE-2026-33142.md): OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters (CVSS 8.1)
- [CVE-2026-33143](https://cve.now/CVE-2026-33143.md): OneUptime: WhatsApp Webhook Missing Signature Verification (CVSS 8.7)
- [CVE-2026-32598](https://cve.now/CVE-2026-32598.md): OneUptime: Password Reset Token Logged at INFO Level (CVSS 6.9)
- [CVE-2026-32308](https://cve.now/CVE-2026-32308.md): OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") (CVSS 7.6)
- [CVE-2026-32306](https://cve.now/CVE-2026-32306.md): OneUptime ClickHouse SQL Injection via Aggregate Query Parameters (CVSS 10.0)
- [CVE-2026-30959](https://cve.now/CVE-2026-30959.md): OneUptime has WhatsApp Resend Verification Authorization Bypass (CVSS 5.3)
- [CVE-2026-30958](https://cve.now/CVE-2026-30958.md): OneUptime: Path Traversal — Arbitrary File Read (No Auth) (CVSS 7.2)
- [CVE-2026-30957](https://cve.now/CVE-2026-30957.md): OneUptime Synthetic Monitor RCE via exposed Playwright browser object (CVSS 10.0)
- [CVE-2026-30956](https://cve.now/CVE-2026-30956.md): OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header (CVSS 10.0)
- [CVE-2026-30921](https://cve.now/CVE-2026-30921.md): OneUptime Synthetic Monitor RCE via exposed Playwright browser object (CVSS 10.0)
- [CVE-2026-30920](https://cve.now/CVE-2026-30920.md): OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding (CVSS 8.6)
- [CVE-2026-30887](https://cve.now/CVE-2026-30887.md): OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE (CVSS 10.0)
- [CVE-2026-28787](https://cve.now/CVE-2026-28787.md): OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay (CVSS 8.2)
- [CVE-2026-27728](https://cve.now/CVE-2026-27728.md): OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() (CVSS 10.0)
- [CVE-2026-27574](https://cve.now/CVE-2026-27574.md): OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE (CVSS 10.0)
- [CVE-2025-66028](https://cve.now/CVE-2025-66028.md): OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation (CVSS 6.9)
- [CVE-2025-65966](https://cve.now/CVE-2025-65966.md): OneUptime Unauthorized User Creation via API (CVSS 8.8)
- [CVE-2024-29194](https://cve.now/CVE-2024-29194.md): OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation (CVSS 8.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/oneuptime
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.