https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:39:40 +0000 https://vulnerability.circl.lu/vuln/cve-2026-71285 <p><strong>Affected:</strong> louislam uptime-kuma</p> <p>Uptime Kuma&#39;s Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a &lt;script&gt; block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/&lt;slug&gt; page, enabling session-cookie theft and full page takeover.</p> <p><strong>Affected:</strong> louislam uptime-kuma</p> <p>Uptime Kuma&#39;s Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a &lt;script&gt; block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/&lt;slug&gt; page, enabling session-cookie theft and full page takeover.</p> https://vulnerability.circl.lu/vuln/cve-2026-71285