CVE-2026-34758
🔴 Łataj teraz
Nieautoryzowany dostęp w OneUptime umożliwia nadużycia związane z SMS, połączeniami i zakupem numerów.
CVSS
9.1
EPSS
0.5%
Exploit
poc
Vendor
hackerbay
Opis źródłowy (NVD)
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.1 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.5% |
| Opublikowano (NVD) | 2026-04-02 19:21:33 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-06 22:10:00 UTC |
Referencje
- https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4 ([email protected]) [Patch]
- https://github.com/OneUptime/oneuptime/releases/tag/10.0.42 ([email protected]) [Release Notes]
- https://github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hp ([email protected]) [Exploit, Mitigation, Vendor Advisory]