Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

uptime-kuma — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in uptime-kuma, with AI-generated Chinese analysis, references, and POCs.

Vendor: louislam

CVE ID Title CVSS Severity Published
CVE-2026-71285 Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages CWE-79 8.1 High 2026-08-05
CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh) CWE-98 6.5 Medium 2026-03-20
CVE-2026-32230 Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page CWE-862 5.3 Medium 2026-03-12
CVE-2024-56331 Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor CWE-22 6.8 Medium 2024-12-20
CVE-2023-49805 Uptime Kuma Missing Origin Validation in WebSockets CWE-1385 6.0 Medium 2023-12-11
CVE-2023-49804 Uptime Kuma Password Change Vulnerability CWE-384 6.7 Medium 2023-12-11
CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma CWE-79 6.3 Medium 2023-12-01
CVE-2023-44400 Uptime Kuma has Persistentent User Sessions CWE-384 6.7 Medium 2023-10-09
CVE-2023-36822 Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss CWE-22 6.5 Medium 2023-07-05
CVE-2023-36821 Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation CWE-20 8.8 High 2023-07-05
CVE-2023-25811 Persistent Cross site scripting (XSS) in Uptime Kuma CWE-79 6.3 Medium 2023-02-21
CVE-2023-25810 Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma CWE-79 6.3 Medium 2023-02-21

All 12 known CVE vulnerabilities affecting uptime-kuma with full Chinese analysis, references, and POCs where available.