sysadminsmedia vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202613

Newest CVEs

• CVE-2026-85287

  HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service

  sysadminsmedia · homebox

  Medium6.5
• CVE-2026-75599

  HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields

  sysadminsmedia · homebox

  Medium5.4
• CVE-2026-85286

  HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay

  sysadminsmedia · homebox

  Low3.7
• CVE-2026-116680

  Homebox generic notifier SSRF via HTTP redirect after URL validation

  sysadminsmedia · homebox

  Medium6.4
• CVE-2026-55473

  HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress

  sysadminsmedia · homebox

  Medium6.0
• CVE-2026-48826

  HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching

  sysadminsmedia · homebox

  High8.1
• CVE-2026-48974

  HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler

  sysadminsmedia · homebox

  Medium5.4
• CVE-2026-48975

  HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

  sysadminsmedia · homebox

  High8.1
• CVE-2026-48976

  HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack

  sysadminsmedia · homebox

  High8.1
• CVE-2026-40196

  HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation

  sysadminsmedia · homebox

  High8.1