{"action":"Upgrade oneuptime to 10.0.23 or later.","affected":[{"fixed":"10.0.23","introduced":"0"}],"component":"oneuptime","cve_ids":["CVE-2026-32306"],"ecosystem":"npm","epss":0.00659,"exploited":false,"fixed_versions":["10.0.23"],"ghsa_id":"GHSA-p5g2-jm85-8g35","id":"tcs_01M5KG2M741YYHCTEX7YZCQJ68","modified_at":"2026-03-16T17:16:25.316450Z","published_at":"2026-03-13T20:00:34Z","references":["https://osv.dev/vulnerability/GHSA-p5g2-jm85-8g35","https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p5g2-jm85-8g35","https://nvd.nist.gov/vuln/detail/CVE-2026-32306","https://github.com/OneUptime/oneuptime","https://github.com/OneUptime/oneuptime/releases/tag/10.0.23"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-p5g2-jm85-8g35","url":"https://osv.dev/vulnerability/GHSA-p5g2-jm85-8g35"}],"summary":"OneUptime ClickHouse SQL Injection via Aggregate Query Parameters"}