VulnSocial

CVE-2026-71285Disclosure

LOW

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.0/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-08-05: 3Technical Details · 2026-08-05: 308-05
Signal classification1 categories
Disclosure
3100.0%
Referenced assets2 URLs
By indicator
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-71285 Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript … https://www.cve.org/CVERecord?id=CVE-2026-71285

    Post summary

    The passage reveals a newly disclosed vulnerability (CVE‑2026‑71285) wherein Uptime Kuma’s Matomo integration widens an unquoted JavaScript injection, yet it offers no PoC, exploit, or mitigation details.

    000111.8K
    57.9K followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨High - Uptime Kuma Matomo siteId Stored XSS on Public Status Pages (CVE-2026-71285) Uptime Kuma’s Matomo analytics integration renders the admin-set matomo.siteId into a public /status/ script block as an unquoted JS expression. A crafted siteId using ], ), ;, ( breaks out of context and runs attacker JS on every status page view, enabling stored XSS (cookie theft/page takeover). 👉Affected: uptime-kuma (versions with Matomo integration enabled)

    Post summary

    The post discloses a new high‑severity stored XSS vulnerability (CVE‑2026‑71285) in Uptime Kuma's Matomo integration, detailing the injection vector but not providing PoC or exploitation evidence.

    0000090
    282 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-71285 Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript … https://www.cve.org/CVERecord?id=CVE-2026-71285 ----- Traducción: CVE-2026-71285 La … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-71285, describing a JavaScript injection issue in Uptime Kuma's Matomo analytics integration, without providing PoC, exploit, or patch details.

    0000053
    97 followersView on X

Explore more

Back to dashboard