CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: headlamp, linkerd2, eksctl, zarf, harbor, helm-push, tw, chart-testing, cerbos, helm-operator, trivy-operator, rancher-fleet, chartmuseum, flux-source-controller, consul-k8s, helm-docs, flux, envoy-gateway, helm, helm-mapkubeapis, nova, cert-manager-cmctl,...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, flux, gitlab-operator, rancher-fleet-fips, zarf, zarf-fips, gitlab-operator-fips, kots, helm-push, cert-manager-cmctl-fips, cilium-cli, flux-fips, kuma, helm-diff-fips, cert-manager-cmctl, helm-diff, flux-source-controller-fips...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, flux, gitlab-operator, rancher-fleet-fips, zarf, zarf-fips, gitlab-operator-fips, kots, helm-push, cert-manager-cmctl-fips, cilium-cli, flux-fips, kuma, helm-diff-fips, cert-manager-cmctl, helm-diff, flux-source-controller-fips...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, flux, gitlab-operator, rancher-fleet-fips, zarf, zarf-fips, gitlab-operator-fips, kots, helm-push, cert-manager-cmctl-fips, cilium-cli, flux-fips, kuma, helm-diff-fips, cert-manager-cmctl, helm-diff, flux-source-controller-fips...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, flux, gitlab-operator, rancher-fleet-fips, zarf, zarf-fips, gitlab-operator-fips, kots, helm-push, cert-manager-cmctl-fips, cilium-cli, flux-fips, kuma, helm-diff-fips, cert-manager-cmctl, helm-diff, flux-source-controller-fips...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: rancher-fleet, helm-exporter, nova, zarf-fips, gitlab-operator-fips, helm-docs, helm-exporter-fips, harbor-fips, istio, eksctl, harbor, k9s, cert-manager-cmctl, helm, cloudbeat-fips, cerbos, nova-fips, headlamp-fips, cluster-api-helm-controller-fips, chaos-mesh-fips,...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

EUVD-2026-13670

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130 Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

CVE-2026-33130

Uptime Kuma (versions 1.23.0–2.2.0) is affected by a server-side template injection (SSTI) in notification templates due to an incomplete fix for GHSA-vffh-c9pq-4crh. The Liquid engine mitigations added to limit path resolution (root, relativeReference, dynamicPartials) only block quoted paths; i...

PT-2026-26603

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection SSTI. The three mitigations added to the Liquid engine root, relativeReference, dynamicPartials only block...

Uptime Kuma 安全漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool developed by Louis Lam. Versions of Uptime Kuma from 1.23.0 to 2.2.0 contain security vulnerabilities. These vulnerabilities stem from incomplete protection against server-side template injections, which could allow unauthorized access to...

CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...

CVE-2026-32230

Uptime Kuma (2.0.0–2.1.3) contains a missing authorization check on the GET /api/badge/:id/ping/:duration? endpoint. The ping badge endpoint does not verify that the target monitor belongs to a public group, unlike other badge endpoints that enforce public = 1 in SQL queries. This allows unauthen...

CVE-2026-32230 Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query...