Theonedev vulnerabilities

Products

• Onedev 23

Newest

• theonedev onedev OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar CVE-2026-49248 8.3 HighJune 18, 2026
• theonedev onedev theonedev Pull Request issues canAccessIssue improper authorization CVE-2026-11441 5.3 MediumJune 6, 2026
• theonedev onedev theonedev REST API default-branch improper authorization CVE-2026-11440 5.3 MediumJune 6, 2026
• theonedev onedev theonedev Parent Project projects improper authorization CVE-2026-11439 5.3 MediumJune 6, 2026
• theonedev onedev theonedev projects improper authorization CVE-2026-11438 5.3 MediumJune 6, 2026
• theonedev onedev OneDev: Path Traversal (read capability via Git LFS pointer resolution) CVE-2026-44647 7.1 HighMay 14, 2026
• onedev project onedev OneDev vulnerable to arbitrary file reading for unauthenticated user CVE-2024-45309 EPSS 24.5% 8.7 HighOctober 21, 2024
• onedev project onedev Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev CVE-2023-24828 8.1 HighFebruary 7, 2023
• onedev project onedev CI/CD Docker Escape in OneDev CVE-2022-39206 9.9 CriticalSeptember 13, 2022
• onedev project onedev Persistent XSS in OneDev CVE-2022-39207 5.4 MediumSeptember 13, 2022
• onedev project onedev Git Repository Disclosure in Onedev CVE-2022-39208 7.5 HighSeptember 13, 2022
• onedev project onedev Access Control Bypass in Onedev CVE-2022-39205 9.0 CriticalSeptember 13, 2022
• onedev project onedev LDAP injection via OneDev may leak some LDAP directory information CVE-2021-32651 3.1 LowJune 1, 2021
• onedev project onedev Pre-Auth Arbitrary File Upload CVE-2021-21245 10.0 CriticalJanuary 15, 2021
• onedev project onedev Pre-Auth Access token leak CVE-2021-21246 EPSS 49.1% 8.6 HighJanuary 15, 2021
• onedev project onedev Post-Auth Unsafe Deserialization on BasePage (AJAX) CVE-2021-21247 9.6 CriticalJanuary 15, 2021
• onedev project onedev Post-Auth Unsafe Yaml deserialization CVE-2021-21249 9.6 CriticalJanuary 15, 2021
• onedev project onedev Post-Auth Arbitrary Code execution via Groovy script injection CVE-2021-21248 9.6 CriticalJanuary 15, 2021
• onedev project onedev Post-Auth External Entity Expansion (XXE) CVE-2021-21250 7.7 HighJanuary 15, 2021
• onedev project onedev ZipSlip Arbitrary File Upload CVE-2021-21251 EPSS 12.7% 7.7 HighJanuary 15, 2021
• onedev project onedev Pre-Auth Unsafe Deserialization on AttachmentUploadServet CVE-2021-21242 EPSS 74.2% 10.0 CriticalJanuary 15, 2021
• onedev project onedev Pre-Auth Unsafe Deserialization on KubernetesResource CVE-2021-21243 EPSS 54.5% 10.0 CriticalJanuary 15, 2021
• onedev project onedev Pre-Auth SSTI via Bean validation message tampering CVE-2021-21244 10.0 CriticalJanuary 15, 2021