IIceWhaleTech

Products

Exploited and recent CVEs

• CVE-2026-28798 Critical 9.1 Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS 0.4%
• CVE-2026-28442 High 8.6 ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation 0.3%
• CVE-2025-64427 High 7.1 ZimaOS is vulnerable to Server-Side Request Forgery (SSRF) 0.3%
• CVE-2026-28286 High 8.6 ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API 0.5%
• CVE-2026-21891 Critical 9.4 ZimaOS has Authentication Bypass via System-Level Username 2.3%
• CVE-2025-58432 Medium 5.2 ZimaOS Privilege Escalation using localhost calls to File API Upload 0.2%
• CVE-2025-58431 Medium 4.8 ZimaOS reads arbitrary files using localhost calls to File API Download 0.2%
• CVE-2024-49359 High 7.5 ZimaOS vulnerable to Directory Listing via Parameter Manipulation 1.0%
• CVE-2024-49358 Medium 5.3 ZimaOS vulnerable to Username Enumeration via API Responses 0.5%
• CVE-2024-49357 High 7.5 ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak 23.7%
• CVE-2024-48932 Medium 5.3 ZimaOS Unauthenticated API Discloses Usernames 0.5%
• CVE-2024-48931 High 7.5 ZimaOS Arbitrary File Read via Parameter Manipulation 0.7%
• CVE-2024-28232 Medium 6.2 Username Enumeration in CasaOS via bypass of CVE-2024-24766 0.6%
• CVE-2024-24766 Medium 6.2 CasaOS Username Enumeration 0.8%
• CVE-2024-24767 Critical 9.1 CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability 1.0%
• CVE-2024-24765 High 7.5 CasaOS-UserService allows unauthorized access to any file 1.0%
• CVE-2023-37469 High 8.8 CasaOS Command Injection vulnerability 1.6%
• CVE-2023-37265 Critical 9.8 Incorrect identification of source IP addresses in CasaOS 7.4%
• CVE-2023-37266 Critical 9.8 Weak json web token (JWT) secrets in CasaOS 6.8%