CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: headlamp, chart-testing, cilium-cli, cluster-api-helm-controller, helm-set-status, cerbos, tigera-operator, kube-arangodb, kuma, helm-operator, zot, consul-k8s, teleport, helm-push, nova, pluto, kots, kubescape, harbor, rancher-fleet, cert-manager-cmctl, linkerd2,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: headlamp, chart-testing, cilium-cli, cluster-api-helm-controller, helm-set-status, cerbos, tigera-operator, kube-arangodb, kuma, helm-operator, zot, consul-k8s, teleport, helm-push, nova, pluto, kots, kubescape, harbor, rancher-fleet, cert-manager-cmctl, linkerd2,...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-fips, gitlab-operator, flux-source-controller-fips, zarf, flux-source-controller, kots, rancher-fleet, rancher-fleet-fips, helm-diff, helm-diff-fips, flux, helm-push, cilium-cli, kuma, cert-manager-cmctl, gitlab-operator-fips, zarf-fips...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-fips, gitlab-operator, flux-source-controller-fips, zarf, flux-source-controller, kots, rancher-fleet, rancher-fleet-fips, helm-diff, helm-diff-fips, flux, helm-push, cilium-cli, kuma, cert-manager-cmctl, gitlab-operator-fips, zarf-fips...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-fips, gitlab-operator, flux-source-controller-fips, zarf, flux-source-controller, kots, rancher-fleet, rancher-fleet-fips, helm-diff, helm-diff-fips, flux, helm-push, cilium-cli, kuma, cert-manager-cmctl, gitlab-operator-fips, zarf-fips...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-fips, gitlab-operator, flux-source-controller-fips, zarf, flux-source-controller, kots, rancher-fleet, rancher-fleet-fips, helm-diff, helm-diff-fips, flux, helm-push, cilium-cli, kuma, cert-manager-cmctl, gitlab-operator-fips, zarf-fips...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: k9s-fips, chaos-mesh-fips, kots, chartmuseum, flux, helm-push, cilium-cli, zot, tigera-operator, cloudbeat-fips, chart-testing, chartmuseum-fips, istio, rancher-fleet-fips, kube-arangodb, kubescape-server, helm-operator-fips, envoy-gateway, flux-fips,...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

EUVD-2026-13670

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma (versions 1.23.0–2.2.0) is affected by a server-side template injection (SSTI) in notification templates due to an incomplete fix for GHSA-vffh-c9pq-4crh. The Liquid engine mitigations added to limit path resolution (root, relativeReference, dynamicPartials) only block quoted paths; i...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

Uptime Kuma 安全漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool developed by Louis Lam. Versions of Uptime Kuma from 1.23.0 to 2.2.0 contain security vulnerabilities. These vulnerabilities stem from incomplete protection against server-side template injections, which could allow unauthorized access to...

PT-2026-26603

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-32230 Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...