Uptime.Kuma is a modestly represented, open-source monitoring and status-page application that occupies a focused role in infrastructure visibility despite its niche scope; its presence in the landscape reflects growing adoption of lightweight, self-hosted monitoring solutions. The vendor's exposure recurs through a consistent cluster of web-application and session-handling weakness classes—cross-site scripting, PHP remote file inclusion, session fixation, missing authorization, and template-engine injection—reflecting the attack surface inherent to a user-facing web application and the input-validation and access-control discipline such applications demand. Defenders tracking this vendor should treat its advisories as relevant to any self-hosted monitoring footprint; live severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Uptime.Kuma over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-32230MEDIUM Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify th | Mar 12, 2026 | 5.3 | 30 | NO | YES |
CVE-2023-49805HIGH Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of commu | Dec 11, 2023 | 8.8 | 23 | NO | NO |
CVE-2023-44400HIGH Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verifi | Oct 9, 2023 | 7.8 | 23 | NO | NO |
CVE-2026-33130MEDIUM Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Inj | Mar 20, 2026 | 6.5 | 22 | NO | NO |
CVE-2023-49804HIGH Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains acc | Dec 11, 2023 | 7.8 | 21 | NO | NO |
CVE-2023-49276MEDIUM Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (X | Dec 1, 2023 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Uptime.Kuma.
Media articles that mention a CVE ID that affects a product developed by Uptime.Kuma — matched by CVE ID, not by vendor name.