Ssysadminsmedia

Products

Exploited and recent CVEs

• CVE-2026-85287 Medium 6.5 HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service 0.3%
• CVE-2026-75599 Medium 5.4 HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields 0.2%
• CVE-2026-85286 Low 3.7 HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay 0.3%
• CVE-2026-116680 Medium 6.4 Homebox generic notifier SSRF via HTTP redirect after URL validation 0.2%
• CVE-2026-55473 Medium 6.0 HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress 0.4%
• CVE-2026-48826 High 8.1 HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching 0.5%
• CVE-2026-48974 Medium 5.4 HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler 0.3%
• CVE-2026-48975 High 8.1 HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox 0.5%
• CVE-2026-48976 High 8.1 HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack 0.4%
• CVE-2026-40196 High 8.1 HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation 0.2%
• CVE-2026-27981 High 7.4 HomeBox has an Auth Rate Limit Bypass via IP Spoofing 0.3%
• CVE-2026-27600 Medium 5.0 HomeBox affected by Blind SSRF 0.2%
• CVE-2026-26272 Medium 4.6 HomeBox affected by Stored XSS via HTML/SVG Attachment Upload 0.2%
• CVE-2025-53108 Medium 5.3 HomeBox Missing User Authorization 0.3%