Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : Local File Inclusion LFI via Improper URL Handling in Real-Browser monitor Summary An Improper URL Handling Vulnerability allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This vulnerability is triggered via the...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, cluster-api-ipam-provider-in-cluster, k8ssandra-client, kubernetes-csi-external-health-monitor, descheduler, cluster-api-gcp-controller, rancher-agent, kubernetes-csi-external-snapshotter, spicedb, opentelemetry-operator, cass-operator,...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: delve, hubble, kuma, nerdctl, witness, kubescape-operator, docker, kubescape, cilium, gitaly, hubble-ui, k3s, runc, vitess, splunk-otel-collector, containerd, falcoctl...

GHSA-XHGW-QWWF-PG32 vulnerabilities

Vulnerabilities for packages: delve, hubble, kuma, nerdctl, witness, kubescape-operator, docker, kubescape, cilium, gitaly, hubble-ui, k3s, runc, vitess, splunk-otel-collector, containerd, falcoctl...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

GO-2026-5102 vulnerabilities

Vulnerabilities for packages: kuma...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, cilium-cli, linkerd2, cerbos-fips, harbor, cert-manager-cmctl-fips, flux, helm-docs, k9s, flux-helm-controller, trivy, helm-operator-fips, kargo, cert-manager-cmctl, flux-source-controller, linkerd2-fips, flux-fips, cluster-api-helm-controller,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, cilium-cli, harbor, cert-manager-cmctl-fips, flux, helm-docs, cluster-api-helm-controller-fips, k9s, flux-helm-controller, trivy, helm-operator-fips, cert-manager-cmctl, flux-source-controller, flux-fips, cluster-api-helm-controller,...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, cilium-cli, harbor, cert-manager-cmctl-fips, flux, helm-docs, cluster-api-helm-controller-fips, k9s, flux-helm-controller, trivy, helm-operator-fips, cert-manager-cmctl, flux-source-controller, flux-fips, cluster-api-helm-controller,...

GO-2026-5435 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, cilium-cli, zarf-fips, gitlab-operator, linkerd2, cerbos-fips, harbor, cert-manager-cmctl-fips, helm-mapkubeapis, flux, helm-docs, cluster-api-helm-controller-fips, k9s, trivy, cloudbeat-fips, helm-operator-fips, cert-manager-cmctl,...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: datadog-agent, multus-cni, containerd-fips, rke2-runtime, flannel-fips, datadog-agent-fips, multus-cni-fips, nerdctl, docker, buildkitd, calico, calico-fips, rootlesskit-fips, kuma, nerdctl-fips, buildkitd-fips, istio, docker-fips, flannel, istio-fips, azure-ipam,...

GO-2026-5102 vulnerabilities

Vulnerabilities for packages: kuma...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: helm-push, cilium-cli, rancher-fleet, zarf, kots, kuma, cert-manager-cmctl, flux-source-controller, flux...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: helm-push, cilium-cli, rancher-fleet, zarf, kots, kuma, cert-manager-cmctl, flux-source-controller, flux...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: rootlesskit, podman, nerdctl, multus-cni, flannel, azure-ipam, docker, istio, k3s, buildkitd, calico, kuma, containerd, buildah, datadog-agent...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: harbor-scanner-trivy, amazon-cloudwatch-agent-operator, cortex, neuvector-dbgen, pulumi-kubernetes-operator, stakater-reloader, gostatsd, manifest-tool, steampipe, haproxy-ingress, cluster-api-ipam-provider-in-cluster, runc, speedtest-go, opentofu, witness,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: dex, amazon-cloudwatch-agent-operator, cortex, maru, stakater-reloader, cfssl, gostatsd, manifest-tool, aws-sigv4-proxy, kubernetes-dns-node-cache, metacontroller, steampipe, cluster-api-ipam-provider-in-cluster, runc, crossplane-provider-aws-iam, swagger, opentofu,...

CVE-2026-18679

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...