SY
Vendor
sysadminsmedia
11
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116680 New | HO homebox sysadminsmedia | 6.4 | Oct 27 | Homebox generic notifier SSRF via HTTP redirect after URL validation |
| CVE-2026-55473 | HO homebox sysadminsmedia | 6.0 | Sep 21 | HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress |
| CVE-2026-48826 | HO homebox sysadminsmedia | 8.1 | Sep 21 | HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching |
| CVE-2026-48974 | HO homebox sysadminsmedia | 5.4 | Sep 21 | HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler |
| CVE-2026-48975 | HO homebox sysadminsmedia | 8.1 | Sep 21 | HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox |
| CVE-2026-48976 | HO homebox sysadminsmedia | 8.1 | Sep 21 | HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack |
| CVE-2026-40196 | HO homebox sysadminsmedia | 8.1 | Apr 17 | HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation |
| CVE-2026-27981 | HO homebox sysadminsmedia | 7.4 | Mar 3 | HomeBox has an Auth Rate Limit Bypass via IP Spoofing |
| CVE-2026-27600 | HO homebox sysadminsmedia | 4.3 | Mar 3 | HomeBox affected by Blind SSRF |
| CVE-2026-26272 | HO homebox sysadminsmedia | 5.4 | Mar 3 | HomeBox affected by Stored XSS via HTML/SVG Attachment Upload |
| CVE-2025-53108 | HO homebox sysadminsmedia | 5.3 | Jul 2 | HomeBox Missing User Authorization |