HO
Product
homebox
11
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Severity mix
Critical 0High 5Medium 6Low 0
Watch
Add homebox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48826 | 8.1 | Sep 21 | HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching Affected: < 0.26.0 |
| CVE-2026-48975 | 8.1 | Sep 21 | HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox Affected: < 0.26.0 |
| CVE-2026-48976 | 8.1 | Sep 21 | HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack Affected: < 0.26.0 |
| CVE-2026-40196 | 8.1 | Apr 17 | HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation Affected: < 0.25.0 |
| CVE-2026-27981 | 7.4 | Mar 3 | HomeBox has an Auth Rate Limit Bypass via IP Spoofing Affected: < 0.24.0 |
Showing 5