245 matches found
CVE-2023-49276
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...
CVE-2023-49805
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...
CVE-2025-67499 vulnerabilities
Vulnerabilities for packages: containerd-fips, amazon-k8s-cni-fips, flannel-fips, kuma, nerdctl, containerd, docker, podman, calico, rke2-runtime, azure-ipam, multus-cni, istio, datadog-agent-fips, rootlesskit, multus-cni-fips, buildkitd, buildah, buildkitd-fips, flannel, calico-fips, docker-fips...
GHSA-JV3W-X3R3-G6RM vulnerabilities
Vulnerabilities for packages: containerd-fips, amazon-k8s-cni-fips, flannel-fips, kuma, nerdctl, containerd, docker, podman, calico, rke2-runtime, azure-ipam, multus-cni, istio, datadog-agent-fips, rootlesskit, multus-cni-fips, buildkitd, buildah, buildkitd-fips, flannel, calico-fips, docker-fips...
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
GHSA-VFFH-C9PQ-4CRH Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
EUVD-2025-35098
Uptime Kuma Server-side Template Injection SSTI in Notification Templates Allows Arbitrary File Read...
EUVD-2023-29703
Malicious code in bioql PyPI...
EUVD-2023-2738
Malicious code in bioql PyPI...
EUVD-2023-3036
Malicious code in bioql PyPI...
EUVD-2025-6495
Malicious code in bioql PyPI...
EUVD-2024-1492
Malicious code in bioql PyPI...
EUVD-2024-36154
Malicious code in bioql PyPI...
EUVD-2023-30570
Malicious code in bioql PyPI...
EUVD-2023-53715
Malicious code in bioql PyPI...
EUVD-2024-1816
Malicious code in bioql PyPI...
EUVD-2023-3159
Malicious code in bioql PyPI...
EUVD-2023-29704
Malicious code in bioql PyPI...
GHSA-8PJC-487G-W6P2 vulnerabilities
Vulnerabilities for packages: ratify, tekton-pipelines, gobuster, terraform, trivy, kubernetes-dashboard-web, zot, cg, neuvector-sigstore-interface, gcp-compute-persistent-disk-csi-driver, steampipe, monstache, cerbos, prometheus-operator, tempo, google-osconfig-agent, yunikorn-k8shim, kpt, rclon...
CVE-2025-55199 vulnerabilities
Vulnerabilities for packages: helm-push, trivy-operator, k8ssandra-client, k8sgpt, kubescape, rancher-fleet, k9s, helm-operator, cluster-api-helm-controller, cerbos, pluto, cert-manager-cmctl, chartmuseum, istio, zot, headlamp, trivy, helm-docs, helm-set-status, cilium-cli, linkerd2, zarf, nova,...