Skip to content
OpenAdvisories

Package · npm

oneuptime

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-33142

    OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters

    OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the s…

    OneUptime oneuptime oneuptime npm
  • High 8.7
    CVE-2026-33143

    OneUptime: WhatsApp Webhook Missing Signature Verification

    OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 H…

    OneUptime oneuptime oneuptime npm
  • High 7.6
    CVE-2026-32308

    OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactiv…

    OneUptime oneuptime oneuptime npm