Loading story…
A high-severity stored cross-site scripting flaw, tracked as CVE-2026-71285, was disclosed in Uptime Kuma, the self-hosted monitoring tool maintained in the louislam/uptime-kuma project. The vulnerability affects versions up to and including 2.4.0 and stems from the product's Matomo analytics integration, where the admin-configurable siteId is inserted into a JavaScript block on public status pages without proper neutralization of characters such as ], ), ;, and (.
An attacker with editor or admin access can store a malicious value such as 1]);alert(document.cookie)//, which then executes arbitrary JavaScript when unauthenticated users visit /status/<slug> pages. The issue is rated CVSS 8.1 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, and reported impact includes session-cookie theft and full compromise of the rendered page; recommended remediation is to validate and escape the Matomo siteId input and update Uptime Kuma to a fixed release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE record was published for a high-severity stored XSS vulnerability in Uptime Kuma's Matomo analytics integration affecting versions up to and including 2.4.0. The issue allows an editor or admin to save a malicious Matomo siteId that executes arbitrary JavaScript for visitors to public status pages.
The Uptime Kuma project was published on GitHub as a self-hosted monitoring tool repository under louislam/uptime-kuma.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026
Checkmk disclosed two stored cross-site scripting vulnerabilities affecting **Checkmk 2.5.0 beta releases before `2.5.0b2`**. The issues, tracked as **`CVE-2026-33276`** and **`CVE-2026-20915`**, allow authenticated users to inject malicious JavaScript that later executes in other users’ browsers. Both flaws are classified as **`CWE-79`** and are remotely exploitable with low attack complexity, though successful exploitation requires user interaction. The first bug, **`CVE-2026-33276`**, affects the **Unified Search** feature and stems from unescaped host or service names, enabling users with permission to create hosts or services to plant persistent script payloads. The second, **`CVE-2026-20915`**, affects the **Pending Changes** sidebar and allows users with permission to create pending changes to inject stored JavaScript viewed by other users. Checkmk published vendor advisories for the flaws as **Werk `19525`** and **Werk `19526`**, and both issues were reported to `security@checkmk.com`.
Jun 29, 2026
Open WebUI disclosed and fixed **CVE-2026-70492**, a high-severity stored cross-site scripting flaw affecting versions `0.10.0` through before `0.11.0`. The bug was traced to `src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte`, where KaTeX rendering failures could cause the application to insert the original math source into the page through an unescaped `{@html}` path instead of safely rendering it as text. The vulnerability is rated **CVSS 8.7** and classified as **CWE-79**. An attacker able to submit a crafted chat message could trigger script execution in the browser of anyone viewing the message, including users in shared chats and channels, creating a path to steal session tokens from `localStorage` and potentially take over administrator accounts. The issue was reachable through normal message rendering, including malformed or deeply nested brace input that caused non-`ParseError` KaTeX failures such as `RangeError`. Open WebUI addressed the flaw by escaping the fallback content rather than injecting it as HTML, and the fix was merged under pull request **#26718** before release in version `0.11.0`.
Aug 5, 2026