HIGHnpm
GHSA-g5ph-f57v-mwjc· CVE-2026-33143OneUptime WhatsApp Webhook Missing Signature Verification
Modified: 3/20/2026
package
npm/oneuptime
pkg:npm/oneuptime
MEDIUMnpm
GHSA-4524-cj9j-g4fj· CVE-2026-32598OneUptime: Password Reset Token Logged at INFO Level
Modified: 3/16/2026
HIGH8.1npm
GHSA-gcg3-c5p2-cqgg· CVE-2026-33142OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Modified: 3/20/2026
CRITICAL9.9npm
GHSA-p5g2-jm85-8g35· CVE-2026-32306OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
Modified: 3/16/2026
HIGH7.6npm
GHSA-wvh5-6vjm-23qh· CVE-2026-32308OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Modified: 3/16/2026