Loading story…
Two high-severity vulnerabilities were disclosed in OneUptime, an open-source monitoring and observability platform, affecting webhook handling and synthetic monitoring. CVE-2026-33143 impacts versions before 10.0.34 and stems from missing verification of the Meta/WhatsApp X-Hub-Signature-256 HMAC signature in the POST /notification/whatsapp/webhook handler. An unauthenticated attacker could forge WhatsApp status update payloads, manipulate notification delivery records, suppress alerts, and corrupt audit trails. The issue was classified as CWE-345 and patched in version 10.0.34.
A second flaw, CVE-2026-33396, affects versions before 10.0.35 and allows a low-privileged authenticated user with the ProjectMember role to achieve remote command execution on the Probe container or host through Synthetic Monitor Playwright script execution. The weakness lies in VMRunner.runCodeInNodeVM, where sandboxed code retained access to a live Playwright page object and could reach dangerous methods such as _browserType.launchServer(...), bypassing an incomplete denylist. The vulnerability was mapped to CWE-78, CWE-693, and CWE-184, carries a CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H rating, and was fixed in OneUptime version 10.0.35.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-33396 was documented as a vulnerability in OneUptime versions prior to 10.0.35, enabling authenticated low-privilege users to execute arbitrary commands through the Synthetic Monitor Playwright runtime. Public details explained that attackers could reach _browserType.launchServer via page.context().browser() to spawn processes.
OneUptime released version 10.0.35 to address a sandbox escape in the Synthetic Monitor Playwright runtime. The flaw allowed a low-privileged ProjectMember user to achieve remote command execution on the Probe container or host by abusing exposed Playwright objects and incomplete sandbox restrictions.
A high-severity vulnerability, CVE-2026-33143, was publicly disclosed for OneUptime, describing missing signature verification in the /notification/whatsapp/webhook endpoint. The flaw could let unauthenticated attackers forge webhook payloads, suppress alerts, and corrupt audit trails.
OneUptime fixed a vulnerability in the WhatsApp POST webhook handler that failed to verify the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing forged status update payloads to manipulate notification records and audit trails. The issue affected versions prior to 10.0.34.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **OneUptime** exposed unauthenticated endpoints that let remote attackers trigger sensitive actions without logging in. In versions before `10.0.42`, the Worker service's `GET` and `POST /workflow/manual/run/:workflowId` endpoints lacked authentication, allowing anyone who knew or guessed a workflow ID to execute workflows with attacker-controlled input. The issue could lead to JavaScript execution, notification abuse, and unauthorized data manipulation, and was tracked as **`CVE-2026-35053`** under **`CWE-306`**. A separate flaw, **`CVE-2026-34759`**, affected notification API endpoints exposed through the Nginx proxy at `/notification/` without the expected authorization middleware. Attackers could combine those endpoints with a `projectId` leak from the public Status Page API to abuse a victim's Twilio account, purchase phone numbers, delete existing alerting numbers, disrupt service, and expose SMTP credentials. Both vulnerabilities were disclosed through GitHub security advisories and patched in **OneUptime `10.0.42`**.
Jun 29, 2026
Two high-severity vulnerabilities in **OpenHarness** exposed administrative functionality to remote users through the platform’s gateway and channel layers. `CVE-2026-40502` affects versions prior to commit `dd1d235` and stems from insufficient separation between local-only and remote-safe commands in the gateway handler, allowing remote gateway users with chat access to invoke sensitive administrative actions such as changing permission modes on a running instance without operator approval. The issue is classified as `CWE-862` and carries a CVSS v3.1 score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. A second flaw, `CVE-2026-6819`, affects HKUDS OpenHarness prior to the fix delivered in pull request `#156` and later release `v0.1.7`, exposing plugin lifecycle commands including `/plugin install`, `/plugin enable`, `/plugin disable`, and `/reload-plugins` to remote senders by default. An attacker who gains access through the channel layer could use the weakness to install or activate untrusted plugins and alter plugin trust state remotely, creating a path to full compromise of confidentiality, integrity, and availability. The vulnerability is tracked as `CWE-276` with CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`.
Jun 29, 2026
UpSnap disclosed and patched two high-severity vulnerabilities in version **5.4.0** affecting the wake-on-LAN web application. One flaw, tracked as **`CVE-2026-49819`**, affected fresh installations from versions **4.4.1 through 5.3.5** and allowed an unauthenticated network-adjacent attacker to complete the initial setup flow first, claim the first superuser account, and obtain a long-lived JWT. The issue could then be chained into root-level remote code execution through the application's wake functionality, yielding a **CVSS 9.8** rating. A second flaw, **`CVE-2026-49481`**, was an authenticated OS command injection bug in device management that let a low-privileged user inject shell metacharacters into **IP** or **MAC** fields used by `wake_cmd` and `shutdown_cmd`, leading to command execution via `/bin/sh -c` on Linux or `cmd /C` on Windows. UpSnap said the initial setup issue does not affect instances that were already fully initialized, while the command injection risk primarily impacts deployments where untrusted users can create or edit devices. The project mitigated the bugs by moving first superuser creation to a one-time PocketBase link shown only in server console logs, validating IP and MAC values in the backend, adding PocketBase regex constraints, and enforcing browser-side input patterns.
Aug 13, 2026