Hackerbay's vulnerability footprint centers on OneUptime, a monitoring and incident-management platform, with a concentration of disclosures that skew strongly toward critical-severity outcomes across a relatively contained product scope. The recurring pattern reflects authorization and access-control defects: missing authorization checks, authorization bypass through user-controlled keys, improper authorization enforcement, exposed dangerous methods, and code-injection vulnerabilities that are characteristic of web applications with complex permission models and dynamic feature exposure. This vendor's profile indicates that while the product portfolio is narrow, the severity and structural risk of the vulnerabilities that affect it warrant close attention from organizations deploying this platform. Defenders should prioritize Hackerbay advisories and treat this vendor's patches as urgent despite the limited product count; current severity and exploitation data are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hackerbay over time
Signals from CVEs in this vendor scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-30958HIGH OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/docs/:componentName endpoint allows readin | Mar 10, 2026 | 8.6 | 39 | NO | YES |
CVE-2026-33396CRITICAL OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command executio | Mar 26, 2026 | 9.9 | 35 | NO | NO |
CVE-2026-30957CRITICAL OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arb | Mar 10, 2026 | 9.9 | 34 | NO | NO |
CVE-2026-27574CRITICAL OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly docum | Feb 21, 2026 | 9.9 | 34 | NO | NO |
CVE-2026-32306CRITICAL OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, a | Mar 13, 2026 | 9.9 | 33 | NO | NO |
CVE-2026-30956CRITICAL OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and | Mar 10, 2026 | 9.9 | 33 | NO | NO |
CVE-2026-27728HIGH OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allo | Feb 25, 2026 | 8.8 | 32 | NO | NO |
CVE-2026-35053CRITICAL OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manu | Apr 2, 2026 | 9.8 | 31 | NO | NO |
CVE-2026-34758CRITICAL OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allow | Apr 2, 2026 | 9.1 | 31 | NO | NO |
CVE-2026-28787CRITICAL OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the se | Mar 6, 2026 | 9.0 | 31 | NO | NO |
Signals from CVEs in this vendor scope (23 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hackerbay.
Media articles that mention a CVE ID that affects a product developed by Hackerbay — matched by CVE ID, not by vendor name.