CVE-2026-34758

CriticalCVSS 9.1/10Last modified Oct 6, 2026

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
OneUptime	oneuptime	< 10.0.42

References

https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4Patch
https://github.com/OneUptime/oneuptime/releases/tag/10.0.42Release Notes
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hpExploit, Mitigation, Vendor Advisory
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hpExploit, Mitigation, Vendor Advisory

Timeline

Published: Apr 2, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-347598.1OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registe CVE-2026-34767.8A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitr CVE-2026-347607.1vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before version 0.18.0, Librosa defaults to u CVE-2026-347616.5Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure messa CVE-2026-347622.7Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifi CVE-2026-347635.3Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root p CVE-2026-347645.5Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5 CVE-2026-347658.8Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and CVE-2026-347665.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40 CVE-2026-347676.5Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40 CVE-2026-347687.8Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40 CVE-2026-347698.8Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40