Hackerbay Oneuptime vulnerabilities

• hackerbay oneuptime OneUptime: Unauthenticated Workflow Execution via ManualAPI CVE-2026-35053 9.2 CriticalApril 2, 2026
• hackerbay oneuptime OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification CVE-2026-34840 8.1 HighApril 2, 2026
• hackerbay oneuptime OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure CVE-2026-34759 9.2 CriticalApril 2, 2026
• hackerbay oneuptime OneUptime: Missing Authentication on Notification Endpoints CVE-2026-34758 9.1 CriticalApril 2, 2026
• hackerbay oneuptime OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe CVE-2026-33396 10.0 CriticalMarch 26, 2026
• hackerbay oneuptime OneUptime: WhatsApp Webhook Missing Signature Verification CVE-2026-33143 Fix available 8.7 HighMarch 18, 2026
• hackerbay oneuptime OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters CVE-2026-33142 Fix available 8.1 HighMarch 18, 2026
• hackerbay oneuptime OneUptime: Password Reset Token Logged at INFO Level CVE-2026-32598 Fix available 6.9 MediumMarch 12, 2026
• hackerbay oneuptime OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") CVE-2026-32308 Fix available 7.6 HighMarch 12, 2026
• hackerbay oneuptime OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVE-2026-32306 Fix available 10.0 CriticalMarch 12, 2026
• hackerbay oneuptime OneUptime: Path Traversal — Arbitrary File Read (No Auth) CVE-2026-30958 7.2 HighMarch 10, 2026
• hackerbay oneuptime OneUptime has WhatsApp Resend Verification Authorization Bypass CVE-2026-30959 Fix available 5.3 MediumMarch 10, 2026
• hackerbay oneuptime OneUptime Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30957 Fix available 10.0 CriticalMarch 10, 2026
• hackerbay oneuptime OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header CVE-2026-30956 Fix available 10.0 CriticalMarch 10, 2026
• hackerbay oneuptime OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding CVE-2026-30920 Fix available 8.6 HighMarch 9, 2026
• hackerbay oneuptime OneUptime Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30921 Fix available 10.0 CriticalMarch 7, 2026
• hackerbay oneuptime OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE CVE-2026-30887 Fix available 10.0 CriticalMarch 7, 2026
• hackerbay oneuptime OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay CVE-2026-28787 8.2 HighMarch 2, 2026
• hackerbay oneuptime OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVE-2026-27728 Fix available 10.0 CriticalFebruary 25, 2026
• hackerbay oneuptime OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE CVE-2026-27574 Public exploitFix available 10.0 CriticalFebruary 21, 2026
• hackerbay oneuptime OneUptime Unauthorized User Creation via API CVE-2025-65966 Fix available 8.8 HighNovember 26, 2025
• hackerbay oneuptime OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation CVE-2025-66028 Fix available 6.9 MediumNovember 25, 2025
• hackerbay oneuptime OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation CVE-2024-29194 Fix available 8.3 HighMarch 24, 2024