What’s Vulnerable › Products

sysadminsmedia homebox vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your sysadminsmedia homebox version is affected

Latest sysadminsmedia homebox vulnerabilities

• CVE-2026-116680 — Homebox generic notifier SSRF via HTTP redirect after URL validation (CVSS 6.4)
• CVE-2026-55473 — HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress (CVSS 6.0)
• CVE-2026-48976 — HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack (CVSS 8.1)
• CVE-2026-48975 — HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox (CVSS 8.1)
• CVE-2026-48974 — HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler (CVSS 5.4)
• CVE-2026-48826 — HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching (CVSS 8.1)
• CVE-2026-40196 — HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation (CVSS 8.1)
• CVE-2026-27981 — HomeBox has an Auth Rate Limit Bypass via IP Spoofing (CVSS 7.4)
• CVE-2026-27600 — HomeBox affected by Blind SSRF (CVSS 4.3)
• CVE-2026-26272 — HomeBox affected by Stored XSS via HTML/SVG Attachment Upload (CVSS 5.4)
• CVE-2025-53108 — HomeBox Missing User Authorization (CVSS 5.3)