louislam/uptime-kuma Security Advisories | GitStock

medium2026-03-12

Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

GHSA-c7hf-c5p5-5g6h · CVE-2026-32230

medium2025-10-20

Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read

GHSA-vffh-c9pq-4crh

medium2025-03-31

Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

GHSA-hx7h-9vf7-5xhg · CVE-2025-26042

medium2024-12-20

uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor

GHSA-2qgm-m29m-cj2h · CVE-2024-56331

high2024-05-01

Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

GHSA-7grx-f945-mj96 · CVE-2023-36821

medium2024-05-01

Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss

GHSA-vr8x-74pm-6vj7 · CVE-2023-36822

low2024-04-19

Enabling Authentication does not close all logged in socket connections immediately

GHSA-23q2-5gf8-gjpp

medium2023-12-12

Password Change Vulnerability

GHSA-88j4-pcx8-q4q3 · CVE-2023-49804

medium2023-11-27

Uptime Kuma Authenticated remote code execution via TailscalePing

GHSA-hfxh-rjv7-2369

medium2023-11-24

Attribute Injection leading to XSS(Cross-Site-Scripting)

GHSA-v4v2-8h88-65qj · CVE-2023-49276

high2023-10-10

Uptime Kuma has Persistentent User Sessions

GHSA-g9v2-wqcj-j99g · CVE-2023-44400