Advisories · Technology
oneuptime.
Every CVE that names oneuptime among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
- oneuptime
- Broken access control
- CVSS 7.1 High
OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL
- OneUptime
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion
- oneuptime
- CWE-693
- CVSS 9.2 CriticalCritical · CVSS 9+
OneUptime: Unauthenticated Workflow Execution via ManualAPI
- oneuptime
- Authentication bypass
- CVSS 8.1 High
OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification
- oneuptime
- Weak cryptography or TLS
- CVSS 9.2 CriticalCritical · CVSS 9+
OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure
- oneuptime
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
OneUptime: Missing Authentication on Notification Endpoints
- oneuptime
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe
- oneuptime
- Command injection
- CWE-184
- CVSS 7.2 High
OneUptime: Path Traversal — Arbitrary File Read (No Auth)
- oneuptime
- Path traversal