Security
فارسی
All products

@oneuptime/common

npm · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeoverCVE-2026-30956 · GHSA-R5V6-2599-9G3M @oneuptime/common npm Critical Fix reported
OneUptime: Synthetic Monitor RCE via exposed Playwright browser objectCVE-2026-30921 · GHSA-4J36-39GM-8VQ8 @oneuptime/common npm Critical Fix reported
OneUptime has WhatsApp Resend Verification Authorization BypassCVE-2026-30959 · GHSA-CW6X-MW64-Q6PV @oneuptime/common npm Medium Fix reported
OneUptime has Synthetic Monitor RCE via exposed Playwright browser objectCVE-2026-30957 · GHSA-JW8Q-GJVG-8W4Q @oneuptime/common npm Critical Fix reported
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project bindingCVE-2026-30920 · GHSA-656W-6F6C-M9R6 @oneuptime/common npm High Fix reported
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCECVE-2026-30887 · GHSA-H343-GG57-2Q67 @oneuptime/common npm Critical Fix reported
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replayCVE-2026-28787 · GHSA-GJJC-PCWP-C74M @oneuptime/common npm High No fix reported
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()CVE-2026-27728 · GHSA-JMHP-5558-QXH5 @oneuptime/common npm Critical Fix reported
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCECVE-2026-27574 · GHSA-V264-XQH4-9XMM @oneuptime/common npm Critical Fix reported
OneUptime Unauthorized User Creation via APICVE-2025-65966 · GHSA-M449-VH5F-574G @oneuptime/common npm High Fix reported
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation CVE-2025-66028 · GHSA-675Q-66GF-GQG8 @oneuptime/common npm Medium Fix reported