Louislam vulnerabilities
We track 7 vulnerabilities in Louislam products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Louislam vulnerabilities
- 8.8 High severity
dockge: Improper Limitation of a Pathname to a Restricted Directory
Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name
- 8.1 High severity
uptime-kuma: Improper Neutralization of Input During Web Page Generation
Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once
- 8.8 High severity
uptime-kuma: Origin Validation Error
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on
- 7.8 High severity
uptime-kuma: Session Fixation
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after sy
- 7.8 High severity
uptime-kuma: Session Fixation
Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity period
- 8.1 High severity
uptime-kuma: Improper Limitation of a Pathname to a Restricted Directory
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but
- 8.8 High severity
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a…
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an officia