GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: blob-csi, k8sgateway, gcsfuse, hubble, monstache, rke2-runtime, google-osconfig-agent, karpenter, delve, bom, cert-manager, aactl, eck-operator, rabbitmq-default-user-credential-updater, docker-cli-buildx, zot, helm-set-status, regclient, rancher-security-scan, cerbo...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: headlamp, pluto, helm-docs, linkerd2, k8ssandra-client, kargo, helm-push, kubescape, cerbos, tw, cert-manager-cmctl, cilium-cli, trivy-operator, flux-source-controller, rancher-fleet, k9s, nova, envoy-gateway, cluster-api-helm-controller, flux, k8sgpt,...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: headlamp, pluto, helm-docs, linkerd2, k8ssandra-client, kargo, helm-push, kubescape, cerbos, cert-manager-cmctl, cilium-cli, trivy-operator, flux-source-controller, rancher-fleet, k9s, nova, envoy-gateway, cluster-api-helm-controller, flux, k8sgpt,...

GHSA-F9F8-9PMF-XV68 vulnerabilities

Vulnerabilities for packages: headlamp, pluto, helm-docs, linkerd2, k8ssandra-client, kargo, helm-push, kubescape, cerbos, cert-manager-cmctl, cilium-cli, trivy-operator, flux-source-controller, rancher-fleet, k9s, nova, envoy-gateway, cluster-api-helm-controller, flux, k8sgpt,...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: headlamp, pluto, helm-docs, linkerd2, k8ssandra-client, kargo, helm-push, kubescape, cerbos, tw, cert-manager-cmctl, cilium-cli, trivy-operator, flux-source-controller, rancher-fleet, k9s, nova, envoy-gateway, cluster-api-helm-controller, flux, k8sgpt,...

CVE-2025-53547 vulnerabilities

Vulnerabilities for packages: chart-testing, flux-helm-controller-fips, cluster-api-helm-controller, istio, cilium-cli, harbor-fips, eksctl, linkerd2, rancher-helm, flux-source-controller, helm-docs, trivy-operator-fips, chart-testing-fips, k8ssandra-client-fips, zot, cerbos, trivy-fips, kargo,...

GHSA-557J-XG8C-Q2MM vulnerabilities

Vulnerabilities for packages: chart-testing, flux-helm-controller-fips, cluster-api-helm-controller, istio, cilium-cli, harbor-fips, eksctl, linkerd2, rancher-helm, flux-source-controller, helm-docs, trivy-operator-fips, chart-testing-fips, k8ssandra-client-fips, zot, cerbos, trivy-fips, kargo,...

CVE-2024-36542

Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2023-36822

Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...

CVE-2023-36821

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...

CVE-2023-26777

Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the statuspage.js endpoint...

CVE-2023-25810

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-25811

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma name parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-49804

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

Regular Expression Denial Of Service

uptime-kuma is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regex processing due to catastrophic backtracking triggered by crafted input during notification creation via the web service...

GHSA-HX7H-9VF7-5XHG Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Summary There is a ReDoS vulnerability risk in the system, specifically when administrators create notification through the web servicepushdeer and whapi. If a string is provided that triggers catastrophic backtracking in the regular expression, it may lead to a ReDoS attack. Details The regular...

Regular Expression Denial Of Service (ReDoS)

Uptime Kuma is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to catastrophic backtracking in the regular expression when processing user-provided strings for notifications, allowing an attacker to cause a denial of service with a specially crafted string...

CVE-2025-26042

Uptime Kuma == 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack...

Duplicate Advisory: Uptime Kuma ReDoS vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hx7h-9vf7-5xhg. This link is maintained to preserve external references. Original Description Uptime Kuma == 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through th...

GHSA-3RW8-4XRQ-3F7P Duplicate Advisory: Uptime Kuma ReDoS vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hx7h-9vf7-5xhg. This link is maintained to preserve external references. Original Description Uptime Kuma == 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through th...