One
38 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for One, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.
One CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 1 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 9 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 1 |
| 2026-08 | 8 |
| 2026-09 | 0 |
Severity
How the 38 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High10
- Medium16
Latest CVEs
The 15 most recently published vulnerabilities affecting One.
- CVE-2026-64632A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.—
- CVE-2026-65641A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.—
- CVE-2026-64631A vulnerability allowing a low-privileged user to inject SQL and extract database contents.—
- CVE-2026-64634A vulnerability allowing local privilege escalation to the Reporter service context.—
- CVE-2026-64633A vulnerability allowing remote unauthenticated code execution on the agent host.—
- CVE-2026-64630A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.—
- CVE-2026-58074A vulnerability allowing a high-privileged user to execute arbitrary code on the server.—
- CVE-2026-58075A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally.—
- CVE-2026-12703Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS8.0
- CVE-2026-6840Missing bounds validation for operator could allow out of range operator-code lookup during model loading Affected version is prior to commit 1.30.0.5.5
- CVE-2026-6839Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Open Source ONE Affected version is prio...6.6
- CVE-2026-41667Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0.6.6
- CVE-2026-41666Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation. Affected version is prior to commit 1.30.0.6.6
- CVE-2026-41665Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors. Affected version is prior to comm...6.1
- CVE-2026-41664Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes. Affected version is prior to commit 1.30.0.6.6
Product grouping is registry-driven, with AI assist and human review. How it works