https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35053.htmlhttps://patchthecve.com/cve/CVE-2026-35053.htmlTue, 06 Oct 2026 22:10:00 +0000CRITICAL 9.8: OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints (GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId) without any authentication middleware. An attacker who canhttps://patchthecve.com/cve/CVE-2026-34840.htmlhttps://patchthecve.com/cve/CVE-2026-34840.htmlTue, 06 Oct 2026 22:10:00 +0000HIGH 8.1: OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSignatureValid() verifies the first <Signature> element in the XML Dhttps://patchthecve.com/cve/CVE-2026-34759.htmlhttps://patchthecve.com/cve/CVE-2026-34759.htmlTue, 06 Oct 2026 22:10:00 +0000HIGH 8.1: OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These ehttps://patchthecve.com/cve/CVE-2026-34758.htmlhttps://patchthecve.com/cve/CVE-2026-34758.htmlTue, 06 Oct 2026 22:10:00 +0000CRITICAL 9.1: OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.https://patchthecve.com/cve/CVE-2026-33396.htmlhttps://patchthecve.com/cve/CVE-2026-33396.htmlWed, 07 Oct 2026 08:10:00 +0000CRITICAL 9.9: OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is execut