Skip to contentLouislam Uptime-kuma vulnerabilities
- louislam uptime-kumaUptime Kuma through 2.5.8 Race Condition Admin Creation via Setup HandlerCVE-2026-1195526.3 Medium
- louislam uptime-kumaUptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status PagesCVE-2026-712858.1 High
- uptime.kuma uptime kuma, louislam uptime-kuma +1 moreUptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)CVE-2026-331306.5 Medium
- uptime.kuma uptime kuma, louislam uptime-kuma +1 moreUptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pageCVE-2026-32230Fix available5.3 Medium
- louislam uptime-kumaLocal File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitorCVE-2024-56331Public exploitFix available6.8 Medium
- uptime.kuma uptime kuma, dockge.kuma dockge, louislam uptime-kuma +2 moreUptime Kuma Missing Origin Validation in WebSocketsCVE-2023-498056.0 Medium
- uptime.kuma uptime kuma, dockge.kuma dockge, louislam uptime-kuma +2 moreUptime Kuma Password Change VulnerabilityCVE-2023-49804Fix available6.7 Medium
- louislam uptime-kuma, uptime.kuma uptime kuma +1 moreAttribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kumaCVE-2023-49276Fix available6.3 Medium
- uptime.kuma uptime kuma, louislam uptime-kuma +1 moreUptime Kuma has Persistentent User SessionsCVE-2023-44400Fix available6.7 Medium
- louislam uptime-kumaUptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data lossCVE-2023-36822Fix available6.5 Medium
- louislam uptime-kumaUptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationCVE-2023-36821Fix available8.8 High
- louislam uptime-kumaPersistent Cross site scripting (XSS) in Uptime KumaCVE-2023-258116.3 Medium
- louislam uptime-kumaPersistent Cross site scripting (XSS) through description in status page in Uptime KumaCVE-2023-258106.3 Medium