CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

Summary OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page...

GHSA-H343-GG57-2Q67 OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

Summary OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape this.constructor.constructor, an...

Arbitrary Code Injection

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

CVE-2026-27728

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in NetworkPathMonitor.performTraceroute allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell...

ROS-20260306-73-0008

A vulnerability in the at91gpioprobe function of the drivers/pinctrl/pinctrl-at91.c file of the Linux operating system kernel is related to reading data outside of buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

fastrpc_cb_probe Heap Buffer Overflow DoS

The vulnerability of the fastrpccbprobe function in the drivers/misc/fastrpc.c module of the Linux kernel is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Linux kernel IOMMU Driver DoS

Vulnerability of the armsmmudeviceprobe function in the drivers/iommu/arm/arm-smmu/arm-smmu.c file – The Linux kernel’s IOMMU support driver is vulnerable due to a NULL pointer dereferencing issue. Exploiting this vulnerability could allow an attacker to cause a system failure...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005676)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005676 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: phy: phy-tahvo: fix memory leak in tahvousbprobe Smatch reports: drivers/usb/phy/phy-tahvo.c...

ROS-20260304-73-0016

A vulnerability in the mlbusioprobe function of the Linux kernel is related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005606)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005606 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: phy: phy-tahvo: fix memory leak in tahvousbprobe Smatch reports: drivers/usb/phy/phy-tahvo.c...

Linux Real Time Clock Driver Heap Buffer Overflow DoS

The vulnerability of the msc313rtcprobe function in the drivers/rtc/rtc-msc313.c file of the Linux operating system’s Real Time Clock driver is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to cause a service failure...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-005652)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005652 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/52xx: Fix a resource leak in an error handling path The error handling path of...

vlc:vlc-demux-dec-libfuzzer-image: Heap-buffer-overflow in IsMxpeg

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6476597489369088 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-image Job Type: aflasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x7c6bcc4e17e...

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More

This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, exposed keys, and normal features are being used as entry points. The pattern becomes clear only...

WordPress Slider‑Future 1.0.5 Exposure Scanner

This Metasploit auxiliary module is designed to detect exposure of the WordPress Slider‑Future plugin REST endpoint at /wp-json/slider-future/v1/upload-image/. The module performs a non-intrusive HTTP request OPTIONS method to determine whether the endpoint is accessible. It does not upload files...

CVE-2026-3268

A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/RemoveSessAttributeController.java of the component Session Attribute Handler. Performing a manipulation results in...