uptime-kuma vulnerabilities (npm)

11 vulnerabilities.

• uptime-kuma npm Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page CVE-2026-32230 Fix available 5.3 MediumMarch 12, 2026
• uptime-kuma npm Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read GHSA-vffh-c9pq-4crh 6.5 MediumOctober 20, 2025
• uptime-kuma npm Duplicate Advisory: Uptime Kuma ReDoS vulnerability CVE-2025-26042 Fix available 6.0 MediumMarch 17, 2025
• uptime-kuma npm Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor CVE-2024-56331 Public exploitFix available 6.8 MediumDecember 20, 2024
• uptime-kuma npm Enabling Authentication does not close all logged in socket connections immediately GHSA-23q2-5gf8-gjpp Fix available No scoreApril 19, 2024
• uptime-kuma npm Uptime Kuma Password Change Vulnerability CVE-2023-49804 Fix available 6.7 MediumDecember 11, 2023
• uptime-kuma npm Uptime Kuma Authenticated remote code execution via TailscalePing GHSA-hfxh-rjv7-2369 Fix available No scoreNovember 27, 2023
• uptime-kuma npm Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma CVE-2023-49276 Fix available 6.3 MediumNovember 24, 2023
• uptime-kuma npm Uptime Kuma has Persistentent User Sessions CVE-2023-44400 Fix available 6.7 MediumOctober 9, 2023
• uptime-kuma npm Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss CVE-2023-36822 Fix available 6.5 MediumJuly 5, 2023
• uptime-kuma npm Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation CVE-2023-36821 Fix available 8.8 HighJuly 5, 2023