15
CVEs
7
Critical
5
High
0
KEV
12
PoC
2
Unpatched C/H
86.7%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
7
HIGH
5
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-27728 | OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands on the monitoring server. PoC and patch available. | CRITICAL | 9.9 | 0.4% | 70 |
PoC
|
| CVE-2026-30957 | OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality. | CRITICAL | 9.9 | 0.3% | 70 |
PoC
|
| CVE-2026-27574 | Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available. | CRITICAL | 9.9 | 0.1% | 70 |
PoC
|
| CVE-2026-30887 | OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring configuration. | CRITICAL | 9.9 | 0.0% | 70 |
PoC
|
| CVE-2026-30956 | OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions. | CRITICAL | 9.9 | 0.0% | 70 |
PoC
|
| CVE-2026-30921 | OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution. | CRITICAL | 9.9 | 0.0% | 70 |
PoC
|
| CVE-2025-65966 | OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-30920 | OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by exploiting insufficient validation in the OAuth callback handler, enabling them to redirect repository access and create code records in arbitrary projects. Public exploit code exists for this vulnerability, and GitHub and OneUptime users remain at risk until patches are applied, as no fixes are currently available for the affected GitHub integration. | HIGH | 8.6 | 0.0% | 63 |
PoC
|
| CVE-2026-28787 | OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validation is missing, allowing attackers with a captured assertion to replay valid authentication tokens indefinitely and bypass multi-factor authentication. The vulnerability affects authenticated users and requires only low privileges to exploit, with public exploit code already available. No patches are currently available for this high-severity flaw. | HIGH | 8.2 | 0.0% | 61 |
PoC
No patch
|
| CVE-2026-30958 | Unauthenticated path traversal in OneUptime versions before 10.0.21 allows remote attackers to read arbitrary files from the server via the /workflow/docs/:componentName endpoint, which fails to sanitize user input before passing it to file operations. Public exploit code exists for this vulnerability, affecting all users of vulnerable versions without authentication requirements. Upgrade to version 10.0.21 or later to remediate. | HIGH | 7.2 | 0.1% | 56 |
PoC
No patch
|
| CVE-2025-66028 | OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | MEDIUM | 6.9 | 0.1% | 54 |
PoC
|
| CVE-2026-32306 | SQL injection in OneUptime telemetry API before 10.0.23. | CRITICAL | 9.9 | 0.2% | 50 |
|
| CVE-2026-30959 | OneUptime's resend-verification-code endpoint fails to validate user ownership of WhatsApp records, allowing any authenticated attacker to trigger verification code resends for arbitrary users. Public exploit code exists for this vulnerability, which could enable account enumeration or facilitate phishing attacks against other users. The vulnerability affects the UserWhatsAppAPI and UserWhatsAppService components with no patch currently available. | MEDIUM | 5.0 | 0.0% | 45 |
PoC
|
| CVE-2026-32308 | Cross-site scripting (XSS) vulnerability in OneUptime monitoring platform versions prior to 10.0.23, where the Markdown viewer component renders Mermaid diagrams with insecure settings that allow arbitrary JavaScript execution. An authenticated attacker with low privileges can inject malicious JavaScript through any markdown field (incident descriptions, status pages, monitor notes), potentially compromising other users' sessions. With an EPSS score of only 0.03% and no KEV listing, this appears to be a theoretical risk with no observed exploitation in the wild. | HIGH | 7.6 | 0.0% | 38 |
|
| CVE-2026-32598 | OneUptime versions prior to 10.0.24 contain a sensitive information exposure vulnerability where the password reset flow logs complete password reset URLs containing plaintext reset tokens at the INFO log level, which is enabled by default in production environments. Any actor with access to application logs-including log aggregation systems, Docker logs, or Kubernetes pod logs-can extract these tokens and perform account takeover on any user. The vulnerability is fixed in version 10.0.24. | MEDIUM | 6.5 | 0.0% | 33 |
|