HO
Product
homebox
10
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 5Low 0
Watch
Add homebox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48826 | 8.1 | Sep 21 | HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching Affected: < 0.26.0 |
| CVE-2026-48975 | 8.1 | Sep 21 | HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox Affected: < 0.26.0 |
| CVE-2026-48976 | 8.1 | Sep 21 | HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack Affected: < 0.26.0 |
| CVE-2026-40196 | 8.1 | Apr 17 | HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation Affected: < 0.25.0 |
| CVE-2026-27981 | 7.4 | Mar 3 | HomeBox has an Auth Rate Limit Bypass via IP Spoofing Affected: < 0.24.0 |
| CVE-2026-116680 New | 6.4 | Oct 27 | Homebox generic notifier SSRF via HTTP redirect after URL validation Affected: < 0.27.0 |
| CVE-2026-55473 | 6.0 | Sep 21 | HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress Affected: < 0.26.0 |
| CVE-2026-48974 | 5.4 | Sep 21 | HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler Affected: < 0.26.0 |
| CVE-2026-26272 | 5.4 | Mar 3 | HomeBox affected by Stored XSS via HTML/SVG Attachment Upload Affected: < 0.24.0-rc.1 |
| CVE-2026-27600 | 4.3 | Mar 3 | HomeBox affected by Blind SSRF Affected: < 0.24.0-rc.1 |
Showing 10