Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : Inclusione Locale di File LFI tramite Gestione Impropria degli URL nel monitor Real-Browser Riepilogo Una Vulnerabilità di Gestione Impropria degli URL permette a un attaccante di accedere a file locali sensibili sul server sfruttando il protocollo file:///. Questa...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy, spqr, flux-kustomize-controller, spicedb, kube-state-metrics, rancher-system-agent, cert-manager-istio-csr, hubble, flux-notification-controller, rke2-cloud-provider, cluster-api-aws-controller, emissary, calico, cluster-api-provider-vsphere,...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: nerdctl, hubble-ui, falcoctl, vitess, hubble, k3s, kubescape-operator, witness, kubescape, docker, delve, gitaly, cilium, kuma, splunk-otel-collector, containerd...

GHSA-XHGW-QWWF-PG32 vulnerabilities

Vulnerabilities for packages: nerdctl, hubble-ui, falcoctl, vitess, hubble, k3s, kubescape-operator, witness, kubescape, docker, delve, gitaly, cilium, kuma, splunk-otel-collector, containerd...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

GO-2026-5102 vulnerabilities

Vulnerabilities for packages: kuma...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: helm-operator, linkerd2-fips, zarf, cerbos-fips, kots, k8ssandra-client, cerbos, pluto, tw, harbor-fips, flux, chart-testing-fips, kargo, rancher-fleet-fips, kuma, flux-source-controller, chartmuseum-fips, helm-push, chart-testing, harbor, consul-k8s-fips,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: helm-operator, kubescape, zarf, kots, k8ssandra-client, pluto, tw, harbor-fips, flux, chart-testing-fips, kuma, flux-source-controller, chartmuseum-fips, helm-push, chart-testing, harbor, consul-k8s-fips, rancher-helm, flux-helm-controller-fips, trivy-fips,...

GO-2026-5435 vulnerabilities

Vulnerabilities for packages: tigera-operator, helm-operator, linkerd2-fips, kube-arangodb, kubescape, zarf, zarf-fips, cerbos-fips, jfrog-cli, k8ssandra-client, k9s-fips, kots, cerbos, pluto, tw, cloudbeat-fips, harbor-fips, headlamp-fips, headlamp, flux, chart-testing-fips, rancher-fleet-fips,...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: helm-operator, kubescape, zarf, kots, k8ssandra-client, pluto, tw, harbor-fips, flux, chart-testing-fips, kuma, flux-source-controller, chartmuseum-fips, helm-push, chart-testing, harbor, consul-k8s-fips, rancher-helm, flux-helm-controller-fips, trivy-fips,...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: multus-cni, nerdctl, containerd-fips, nerdctl-fips, datadog-agent, buildah, istio-fips, podman, kuma, azure-ipam, flannel-fips, rootlesskit, flannel, rke2-runtime, rootlesskit-fips, buildkitd-fips, multus-cni-fips, docker-fips, amazon-k8s-cni-fips, containerd, k3s,...

GO-2026-5102 vulnerabilities

Vulnerabilities for packages: kuma...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: flux-source-controller, helm-push, flux, kots, rancher-fleet, cert-manager-cmctl, zarf, cilium-cli, kuma...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: flux-source-controller, helm-push, flux, kots, rancher-fleet, cert-manager-cmctl, zarf, cilium-cli, kuma...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: nerdctl, flannel, podman, buildah, istio, kuma, calico, azure-ipam, k3s, buildkitd, docker, rootlesskit, datadog-agent, multus-cni, containerd...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, kubernetes-event-exporter, jitsucom-bulker, spqr, flux-kustomize-controller, kubo, promxy, witness, dapr, fuse-overlayfs-snapshotter, goreleaser, octo-sts, snyk-cli, zarf, dask-gateway, k9s, kube-state-metrics,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, spqr, x509-certificate-exporter, docker-credential-gcr, flux-kustomize-controller, kubo, fuse-overlayfs-snapshotter, spire-controller-manager, goreleaser, octo-sts, gcp-compute-persistent-disk-csi-driver, go-licenses, dask-gateway,...

CVE-2026-18679

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...