Skip to main content
cve.nowby Sazabi
← npm
npmPackage

uptime-kuma

8 known vulnerabilities (1 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
2.0.0-dev.0 (Aug 11, 2023): no advisory affects it
Newest unaffected release
Every release is affected by at least one advisory
Advisories
8 · 1 high, 7 medium
Weekly downloads
81
Dependents
0
Releases
1 since 2.0.0-dev.0 (Aug 11, 2023)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-32230
    No published release is affected
    No published release is affected
  • CVE-2025-26042
    No published release is affected
    No published release is affected
  • CVE-2024-56331
    No published release is affected
    No published release is affected
  • CVE-2023-49804
    No published release is affected
    No published release is affected
  • CVE-2023-49276
    No published release is affected
    No published release is affected
  • CVE-2023-44400
    No published release is affected
    No published release is affected
  • CVE-2023-36822
    No published release is affected
    No published release is affected
  • CVE-2023-36821
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • CVE-2026-32230Medium 5.3

    Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page

    Affected: from 2.0.0, fixed in 2.2.0.

    No fix released. The advisory names 2.2.0 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • CVE-2025-26042Medium 6.0

    Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service.

    Affected: from 1.15.0, through 1.23.16; from 2.0.0-beta.0, fixed in 2.0.0-beta.2.

    No fix released. The advisory names 2.0.0-beta.2 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • CVE-2024-56331Medium 6.8

    Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor

    Affected: from 1.23.0, fixed in 1.23.16; from 2.0.0-beta.0, fixed in 2.0.0-beta.1.

    No fix released. The advisory names 1.23.16 and 2.0.0-beta.1 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • CVE-2023-49804Medium 6.7

    Uptime Kuma Password Change Vulnerability

    Affected: fixed in 1.23.9.

    No fix released. The advisory names 1.23.9 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • CVE-2023-49276Medium 6.3

    Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

    Affected: from 1.20.0, fixed in 1.23.7.

    No fix released. The advisory names 1.23.7 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • CVE-2023-44400Medium 6.7

    Uptime Kuma has Persistentent User Sessions

    Affected: fixed in 1.23.3.

    No fix released. The advisory names 1.23.3 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • CVE-2023-36822Medium 6.5

    Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss

    Affected: fixed in 1.22.1.

    No fix released. The advisory names 1.22.1 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).

  • Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

    Affected: fixed in 1.22.1.

    No fix released. The advisory names 1.22.1 as the fix, which the registry doesn't have yet.

    0% of uptime-kuma downloads last week were affected versions (0).