CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion. The vulnerability is caused by an unvalidated stack name in the Dockge application, allowing authenticated users to disclose sensitive information and delete arbitrary directories. This issue can be exploited without additional authentication when disableAuth is co [truncated]
Uptime Kuma's Matomo analytics integration is vulnerable to JavaScript injection due to insufficient escaping of the siteId value. This allows an attacker to inject arbitrary JavaScript code, potentially leading to session-cookie theft and full page takeover. The vulnerability exists in the server/analytics/matomo-analytics.js file, where the admin-configurable Matomo siteId value is injected as a bare, u [truncated]
