Login Request a demo
UP
Product
uptime-kuma
by louislam · last CVE Oct 30, 2026
13
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 0High 6Medium 7Low 0
Severity
All severities13Critical0High6Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add uptime-kuma to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-49805
8.8
0%
Dec 11
Uptime Kuma Missing Origin Validation in WebSockets
Affected: < 1.23.9
CVE-2023-36821
8.8
2%
Jul 5
Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation
Affected: < 1.22.1
CVE-2026-71285
8.1
0%
Aug 5
Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages
Affected: through 2.4.0
CVE-2023-36822
8.1
1%
Jul 5
Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss
Affected: < 1.22.1
CVE-2023-49804
7.8
0%
Dec 11
Uptime Kuma Password Change Vulnerability
Affected: < 1.23.9
CVE-2023-44400
7.8
0%
Oct 9
Uptime Kuma has Persistentent User Sessions
Affected: < 1.23.3
CVE-2024-56331
6.8
2%
Dec 20
Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor
Affected: >= 1.23.0, < 1.23.16; = 2.0.0-beta.0
CVE-2026-33130
6.5
0%
Mar 20
Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)
Affected: >= 1.23.0, < 2.2.1
CVE-2023-49276
6.1
0%
Dec 1
Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma
Affected: >= 1.20.0, < 1.23.7
CVE-2023-25811
5.4
0%
Feb 21
Persistent Cross site scripting (XSS) in Uptime Kuma
Affected: < 1.20.0
CVE-2023-25810
5.4
0%
Feb 21
Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma
Affected: < 1.20.0
CVE-2026-32230
5.3
1%
Mar 12
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
Affected: >= 2.0.0, < 2.2.0
CVE-2026-119552
New
4.8–Oct 30
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
Affected: through 2.5.8
Showing 13