agentprime: onedevEvery new CVE for onedev.https://agentprime.io/CVE-2026-49248: OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untarhttps://agentprime.io/advisories/CVE-2026-49248/https://agentprime.io/advisories/CVE-2026-49248/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 18 Jun 2026 19:54:01 GMTCVECVE-2026-11441: theonedev Pull Request issues canAccessIssue improper authorizationhttps://agentprime.io/advisories/CVE-2026-11441/https://agentprime.io/advisories/CVE-2026-11441/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 06 Jun 2026 17:45:10 GMTCVECVE-2026-11440: theonedev REST API default-branch improper authorizationhttps://agentprime.io/advisories/CVE-2026-11440/https://agentprime.io/advisories/CVE-2026-11440/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 06 Jun 2026 17:30:11 GMTCVECVE-2026-11439: theonedev Parent Project projects improper authorizationhttps://agentprime.io/advisories/CVE-2026-11439/https://agentprime.io/advisories/CVE-2026-11439/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 06 Jun 2026 17:15:08 GMTCVECVE-2026-11438: theonedev projects improper authorizationhttps://agentprime.io/advisories/CVE-2026-11438/https://agentprime.io/advisories/CVE-2026-11438/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 06 Jun 2026 17:00:14 GMTCVECVE-2026-44647: OneDev: Path Traversal (read capability via Git LFS pointer resolution)https://agentprime.io/advisories/CVE-2026-44647/https://agentprime.io/advisories/CVE-2026-44647/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 14 May 2026 20:08:10 GMTCVECVE-2024-45309: OneDev vulnerable to arbitrary file reading for unauthenticated userhttps://agentprime.io/advisories/CVE-2024-45309/https://agentprime.io/advisories/CVE-2024-45309/CVSS 8.7 (High). Critical: CVSS score 8.7 (7.0 or more) and EPSS 0.25 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Oct 2024 14:55:18 GMTCVEcriticalCVE-2023-24828: Use of Cryptographically Weak Pseudo-Random Number Generator in Onedevhttps://agentprime.io/advisories/CVE-2023-24828/https://agentprime.io/advisories/CVE-2023-24828/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Feb 2023 23:25:11 GMTCVECVE-2022-39206: CI/CD Docker Escape in OneDevhttps://agentprime.io/advisories/CVE-2022-39206/https://agentprime.io/advisories/CVE-2022-39206/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Sep 2022 18:50:14 GMTCVEcriticalCVE-2022-39207: Persistent XSS in OneDevhttps://agentprime.io/advisories/CVE-2022-39207/https://agentprime.io/advisories/CVE-2022-39207/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Sep 2022 18:50:09 GMTCVECVE-2022-39208: Git Repository Disclosure in Onedevhttps://agentprime.io/advisories/CVE-2022-39208/https://agentprime.io/advisories/CVE-2022-39208/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Sep 2022 18:42:28 GMTCVECVE-2022-39205: Access Control Bypass in Onedevhttps://agentprime.io/advisories/CVE-2022-39205/https://agentprime.io/advisories/CVE-2022-39205/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Sep 2022 18:30:13 GMTCVEcriticalCVE-2021-32651: LDAP injection via OneDev may leak some LDAP directory informationhttps://agentprime.io/advisories/CVE-2021-32651/https://agentprime.io/advisories/CVE-2021-32651/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Jun 2021 17:15:12 GMTCVECVE-2021-21245: Pre-Auth Arbitrary File Uploadhttps://agentprime.io/advisories/CVE-2021-21245/https://agentprime.io/advisories/CVE-2021-21245/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:52 GMTCVEcriticalCVE-2021-21246: Pre-Auth Access token leakhttps://agentprime.io/advisories/CVE-2021-21246/https://agentprime.io/advisories/CVE-2021-21246/CVSS 8.6 (High). Critical: CVSS score 8.6 (7.0 or more) and EPSS 0.49 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:46 GMTCVEcriticalCVE-2021-21247: Post-Auth Unsafe Deserialization on BasePage (AJAX)https://agentprime.io/advisories/CVE-2021-21247/https://agentprime.io/advisories/CVE-2021-21247/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:40 GMTCVEcriticalCVE-2021-21249: Post-Auth Unsafe Yaml deserializationhttps://agentprime.io/advisories/CVE-2021-21249/https://agentprime.io/advisories/CVE-2021-21249/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:31 GMTCVEcriticalCVE-2021-21248: Post-Auth Arbitrary Code execution via Groovy script injectionhttps://agentprime.io/advisories/CVE-2021-21248/https://agentprime.io/advisories/CVE-2021-21248/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:30 GMTCVEcriticalCVE-2021-21250: Post-Auth External Entity Expansion (XXE)https://agentprime.io/advisories/CVE-2021-21250/https://agentprime.io/advisories/CVE-2021-21250/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:21 GMTCVECVE-2021-21251: ZipSlip Arbitrary File Uploadhttps://agentprime.io/advisories/CVE-2021-21251/https://agentprime.io/advisories/CVE-2021-21251/CVSS 7.7 (High). Critical: CVSS score 7.7 (7.0 or more) and EPSS 0.13 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:10:14 GMTCVEcriticalCVE-2021-21242: Pre-Auth Unsafe Deserialization on AttachmentUploadServethttps://agentprime.io/advisories/CVE-2021-21242/https://agentprime.io/advisories/CVE-2021-21242/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.74 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:05:27 GMTCVEcriticalCVE-2021-21243: Pre-Auth Unsafe Deserialization on KubernetesResourcehttps://agentprime.io/advisories/CVE-2021-21243/https://agentprime.io/advisories/CVE-2021-21243/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.54 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:05:21 GMTCVEcriticalCVE-2021-21244: Pre-Auth SSTI via Bean validation message tamperinghttps://agentprime.io/advisories/CVE-2021-21244/https://agentprime.io/advisories/CVE-2021-21244/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 15 Jan 2021 20:05:13 GMTCVEcritical