What’s Vulnerable › Products

louislam uptime-kuma vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your louislam uptime-kuma version is affected

Latest louislam uptime-kuma vulnerabilities

• CVE-2026-119552 — Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler (CVSS 4.8)
• CVE-2026-71285 — Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages (CVSS 8.1)
• CVE-2024-56331 — Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor (CVSS 6.8)
• CVE-2023-36822 — Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss (CVSS 8.1)
• CVE-2023-36821 — Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation (CVSS 8.8)
• CVE-2023-25811 — Persistent Cross site scripting (XSS) in Uptime Kuma (CVSS 5.4)
• CVE-2023-25810 — Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma (CVSS 5.4)