193 matches found
CVE-2026-32230
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...
CVE-2026-32230 Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...
CVE-2026-32230
Uptime Kuma (2.0.0–2.1.3) contains a missing authorization check on the GET /api/badge/:id/ping/:duration? endpoint. The ping badge endpoint does not verify that the target monitor belongs to a public group, unlike other badge endpoints that enforce public = 1 in SQL queries. This allows unauthen...
EUVD-2026-11665
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page...
GHSA-C7HF-C5P5-5G6H Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
Summary The GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely,...
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
Summary The GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely,...
PT-2026-25041
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...
Uptime Kuma 安全漏洞
Uptime Kuma is an easy-to-use, self-hosted monitoring tool developed by Louis Lam as a personal project. Versions of Uptime Kuma from 2.0.0 to 2.1.3 contained security vulnerabilities. These vulnerabilities stemmed from the lack of verification that the monitored devices belonged to public groups...
CVE-2023-49276
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...
CVE-2023-49805
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...
GHSA-JV3W-X3R3-G6RM vulnerabilities
Vulnerabilities for packages: rootlesskit, k3s, istio-fips, datadog-agent, multus-cni-fips, kuma, nerdctl-fips, multus-cni, datadog-agent-fips, podman, calico-fips, amazon-k8s-cni-fips, istio, docker-fips, buildkitd-fips, calico, flannel-fips, nerdctl, buildkitd, flannel, rootlesskit-fips,...
CVE-2025-67499 vulnerabilities
Vulnerabilities for packages: rootlesskit, k3s, istio-fips, datadog-agent, multus-cni-fips, kuma, nerdctl-fips, multus-cni, datadog-agent-fips, podman, calico-fips, amazon-k8s-cni-fips, istio, docker-fips, buildkitd-fips, calico, flannel-fips, nerdctl, buildkitd, flannel, rootlesskit-fips,...
EUVD-2025-35098
Uptime Kuma Server-side Template Injection SSTI in Notification Templates Allows Arbitrary File Read...
GHSA-VFFH-C9PQ-4CRH Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
EUVD-2023-29704
Malicious code in bioql PyPI...
EUVD-2023-30570
Malicious code in bioql PyPI...
EUVD-2023-2738
Malicious code in bioql PyPI...