Login Request a demo
UK
Product
Uptime Kuma
by Uptime.kuma · last CVE Mar 20, 2026
6
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 3Medium 3Low 0
Severity
All severities6Critical0High3Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Uptime Kuma to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-49805
8.8
0%
Dec 11
Uptime Kuma Missing Origin Validation in WebSockets
Affected: before 1.23.9
CVE-2023-49804
7.8
0%
Dec 11
Uptime Kuma Password Change Vulnerability
Affected: before 1.23.9
CVE-2023-44400
7.8
0%
Oct 9
Uptime Kuma has Persistentent User Sessions
Affected: before 1.23.3
CVE-2026-33130
6.5
0%
Mar 20
Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)
Affected: 1.23.0 before 2.2.1
CVE-2023-49276
6.1
0%
Dec 1
Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma
Affected: 1.20.0 before 1.23.7
CVE-2026-32230
5.3
1%
Mar 12
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
Affected: 2.0.0 before 2.2.0
Showing 6