Skip to content
OpenAdvisories

Vendor

louislam

14 known vulnerabilities.

Products

uptime-kuma 13 dockge 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-73040

    Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

    Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.nam…

    louislam dockge
  • High 8.1
    CVE-2026-71285

    Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

    Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once…

    louislam uptime-kuma
  • High 8.8
    CVE-2023-36821

    Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

    Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an offici…

    louislam uptime-kuma uptime-kuma npm