Login Request a demo
HO
Product
homebox
by sysadminsmedia · last CVE Oct 27, 2026
11
CVEs
0
On KEV
8.1
Max CVSS
1
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 5Medium 6Low 0
Severity
All severities11Critical0High5Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add homebox to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-116680
New
6.4–Oct 27
Homebox generic notifier SSRF via HTTP redirect after URL validation
Affected: < 0.27.0
CVE-2026-55473
6.0
0%
Sep 21
HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress
Affected: < 0.26.0
CVE-2026-48974
5.4
0%
Sep 21
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
Affected: < 0.26.0
CVE-2026-26272
5.4
0%
Mar 3
HomeBox affected by Stored XSS via HTML/SVG Attachment Upload
Affected: < 0.24.0-rc.1
CVE-2025-53108
5.3
0%
Jul 2
HomeBox Missing User Authorization
Affected: < 0.20.1
CVE-2026-27600
4.3
0%
Mar 3
HomeBox affected by Blind SSRF
Affected: < 0.24.0-rc.1
Showing 6