# onedev.

Every CVE that names onedev among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar](https://agentprime.io/advisories/CVE-2026-49248.md)
  `CVE-2026-49248` · CVE record: theonedev onedev · CVSS 8.3 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-61
- [theonedev Pull Request issues canAccessIssue improper authorization](https://agentprime.io/advisories/CVE-2026-11441.md)
  `CVE-2026-11441` · CVE record: theonedev onedev · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Privilege escalation, Broken access control
- [theonedev REST API default-branch improper authorization](https://agentprime.io/advisories/CVE-2026-11440.md)
  `CVE-2026-11440` · CVE record: theonedev onedev · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Privilege escalation, Broken access control
- [theonedev Parent Project projects improper authorization](https://agentprime.io/advisories/CVE-2026-11439.md)
  `CVE-2026-11439` · CVE record: theonedev onedev · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Privilege escalation, Broken access control
- [theonedev projects improper authorization](https://agentprime.io/advisories/CVE-2026-11438.md)
  `CVE-2026-11438` · CVE record: theonedev onedev · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Privilege escalation, Broken access control
- [OneDev: Path Traversal (read capability via Git LFS pointer resolution)](https://agentprime.io/advisories/CVE-2026-44647.md)
  `CVE-2026-44647` · CVE record: theonedev onedev · CVSS 7.1 High · Not analysed yet · Published 14 May 2026 · Tags: Path traversal
- [OneDev vulnerable to arbitrary file reading for unauthenticated user](https://agentprime.io/advisories/CVE-2024-45309.md)
  `CVE-2024-45309` · CVE record: theonedev onedev · CVSS 8.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.25 · Not analysed yet · Published 21 Oct 2024 · Tags: Information disclosure
- [Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev](https://agentprime.io/advisories/CVE-2023-24828.md)
  `CVE-2023-24828` · CVE record: theonedev onedev · CVSS 8.1 High · Not analysed yet · Published 7 Feb 2023 · Tags: Weak cryptography or TLS
- [CI/CD Docker Escape in OneDev](https://agentprime.io/advisories/CVE-2022-39206.md)
  `CVE-2022-39206` · CVE record: theonedev onedev · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2022 · Tags: CWE-610
- [Persistent XSS in OneDev](https://agentprime.io/advisories/CVE-2022-39207.md)
  `CVE-2022-39207` · CVE record: theonedev onedev · CVSS 5.4 Medium · Not analysed yet · Published 13 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Git Repository Disclosure in Onedev](https://agentprime.io/advisories/CVE-2022-39208.md)
  `CVE-2022-39208` · CVE record: theonedev onedev · CVSS 7.5 High · Not analysed yet · Published 13 Sept 2022 · Tags: Information disclosure
- [Access Control Bypass in Onedev](https://agentprime.io/advisories/CVE-2022-39205.md)
  `CVE-2022-39205` · CVE record: theonedev onedev · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2022 · Tags: Authentication bypass
- [LDAP injection via OneDev may leak some LDAP directory information](https://agentprime.io/advisories/CVE-2021-32651.md)
  `CVE-2021-32651` · CVE record: theonedev onedev · CVSS 3.1 Low · Not analysed yet · Published 1 Jun 2021 · Tags: Other injection
- [Pre-Auth Arbitrary File Upload](https://agentprime.io/advisories/CVE-2021-21245.md)
  `CVE-2021-21245` · CVE record: theonedev onedev · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2021 · Tags: Unrestricted file upload
- [Pre-Auth Access token leak](https://agentprime.io/advisories/CVE-2021-21246.md)
  `CVE-2021-21246` · CVE record: theonedev onedev · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.49 · Not analysed yet · Published 15 Jan 2021 · Tags: Broken access control
- [Post-Auth Unsafe Deserialization on BasePage (AJAX)](https://agentprime.io/advisories/CVE-2021-21247.md)
  `CVE-2021-21247` · CVE record: theonedev onedev · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2021 · Tags: Other injection
- [Post-Auth Unsafe Yaml deserialization](https://agentprime.io/advisories/CVE-2021-21249.md)
  `CVE-2021-21249` · CVE record: theonedev onedev · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2021 · Tags: Other injection
- [Post-Auth Arbitrary Code execution via Groovy script injection](https://agentprime.io/advisories/CVE-2021-21248.md)
  `CVE-2021-21248` · CVE record: theonedev onedev · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2021 · Tags: Other injection
- [Post-Auth External Entity Expansion (XXE)](https://agentprime.io/advisories/CVE-2021-21250.md)
  `CVE-2021-21250` · CVE record: theonedev onedev · CVSS 7.7 High · Not analysed yet · Published 15 Jan 2021 · Tags: Information disclosure
- [ZipSlip Arbitrary File Upload](https://agentprime.io/advisories/CVE-2021-21251.md)
  `CVE-2021-21251` · CVE record: theonedev onedev · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 15 Jan 2021 · Tags: Path traversal
- [Pre-Auth Unsafe Deserialization on AttachmentUploadServet](https://agentprime.io/advisories/CVE-2021-21242.md)
  `CVE-2021-21242` · CVE record: theonedev onedev · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.74 · Not analysed yet · Published 15 Jan 2021 · Tags: Other injection
- [Pre-Auth Unsafe Deserialization on KubernetesResource](https://agentprime.io/advisories/CVE-2021-21243.md)
  `CVE-2021-21243` · CVE record: theonedev onedev · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.54 · Not analysed yet · Published 15 Jan 2021 · Tags: Other injection
- [Pre-Auth SSTI via Bean validation message tampering](https://agentprime.io/advisories/CVE-2021-21244.md)
  `CVE-2021-21244` · CVE record: theonedev onedev · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2021 · Tags: Other injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=onedev>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/onedev/>. Everything for agents: <https://agentprime.io/llms.txt>.