https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:53:55.284261+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349676 EUVD-2026-349676 2026-10-07T21:53:55.330070+00:00 EUVD-2026-349676 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71285 fkie_cve-2026-71285 2026-10-07T21:53:55.330110+00:00

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.

 https://cve.radiocsirt.org/vuln/ghsa-pf4v-rpp4-fp6r GHSA-pf4v-rpp4-fp6r 2026-10-07T21:53:55.330145+00:00

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page: `_paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);`. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not escape the characters `]`, `)`, `;`, `(`, which are sufficient to break out of the array/push expression context. A siteId value such as `1]);alert(document.cookie)//`, once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover.