GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: flux, kube-arangodb, k8ssandra-client, tw, helm-operator, consul-k8s, kubescape, cluster-api-helm-controller, trivy-operator, eksctl, teleport, harbor, trivy, zot, envoy-gateway, linkerd2, kuma, cilium-cli, chartmuseum, helm-mapkubeapis, headlamp, helm-docs,...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, kots, rancher-fleet-fips, flux, gitlab-operator, kuma, flux-source-controller, flux-source-controller-fips, gitlab-operator-fips, helm-push, zarf-fips, cilium-cli, cert-manager-cmctl, helm-diff, helm-diff-fips, rancher-fleet, flux-fips, zarf...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, kots, rancher-fleet-fips, flux, gitlab-operator, kuma, flux-source-controller, flux-source-controller-fips, gitlab-operator-fips, helm-push, zarf-fips, cilium-cli, cert-manager-cmctl, helm-diff, helm-diff-fips, rancher-fleet, flux-fips, zarf...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, kots, rancher-fleet-fips, flux, gitlab-operator, kuma, flux-source-controller, flux-source-controller-fips, gitlab-operator-fips, helm-push, zarf-fips, cilium-cli, cert-manager-cmctl, helm-diff, helm-diff-fips, rancher-fleet, flux-fips, zarf...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, kots, rancher-fleet-fips, flux, gitlab-operator, kuma, flux-source-controller, flux-source-controller-fips, gitlab-operator-fips, helm-push, zarf-fips, cilium-cli, cert-manager-cmctl, helm-diff, helm-diff-fips, rancher-fleet, flux-fips, zarf...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, consul-k8s, helm-exporter, flux, pluto, k8ssandra-client-fips, helm-operator, k8ssandra-client, gitlab-operator-fips, linkerd2-fips, kubescape, kube-arangodb-fips, envoy-gateway-fips, cluster-api-helm-controller-fips, helm-operator-fips,...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

EUVD-2026-13670

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma (versions 1.23.0–2.2.0) is affected by a server-side template injection (SSTI) in notification templates due to an incomplete fix for GHSA-vffh-c9pq-4crh. The Liquid engine mitigations added to limit path resolution (root, relativeReference, dynamicPartials) only block quoted paths; i...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

Uptime Kuma 安全漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool developed by Louis Lam. Versions of Uptime Kuma from 1.23.0 to 2.2.0 contain security vulnerabilities. These vulnerabilities stem from incomplete protection against server-side template injections, which could allow unauthorized access to...

PT-2026-26603

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-32230 Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-32230

Uptime Kuma (2.0.0–2.1.3) contains a missing authorization check on the GET /api/badge/:id/ping/:duration? endpoint. The ping badge endpoint does not verify that the target monitor belongs to a public group, unlike other badge endpoints that enforce public = 1 in SQL queries. This allows unauthen...