Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

We only support our latest release with security updates.

Password Reset Token Logged at INFO Level
GHSA-4524-cj9j-g4fj published Mar 12, 2026 by simlarsen

High
Predictable Security Tokens Generated with UUID v1
GHSA-f5j9-g76m-vvp9 published Mar 12, 2026 by simlarsen

Moderate
Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
GHSA-wvh5-6vjm-23qh published Mar 12, 2026 by simlarsen

High
ClickHouse SQL Injection via Aggregate Query Parameters
GHSA-p5g2-jm85-8g35 published Mar 12, 2026 by simlarsen

Critical
Authorization bypass via client‑controlled is-multi-tenant-query header leads to cross‑tenant data exposure and account takeover
GHSA-r5v6-2599-9g3m published Mar 8, 2026 by simlarsen

Critical
Synthetic Monitor RCE via exposed Playwright browser object #2
GHSA-jw8q-gjvg-8w4q published Mar 8, 2026 by simlarsen

Critical
Path Traversal — Arbitrary File Read (No Auth)
GHSA-p2wh-9pw8-hvff published Mar 8, 2026 by simlarsen

High
WhatsApp Resend Verification Authorization Bypass
GHSA-cw6x-mw64-q6pv published Mar 8, 2026 by simlarsen

Moderate
Synthetic Monitor RCE via exposed Playwright browser object
GHSA-4j36-39gm-8vq8 published Mar 6, 2026 by simlarsen

Critical
Broken access control in GitHub App installation flow allows unauthorized project binding
GHSA-656w-6f6c-m9r6 published Mar 6, 2026 by simlarsen

High

Learn more about advisories related to OneUptime/oneuptime in the GitHub Advisory Database