Sysadminsmedia Homebox
11 CVEs affecting Sysadminsmedia Homebox. Latest disclosed: 2026-10-27. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48976 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifi… |
CVE-2026-48975 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/intern… |
CVE-2026-48826 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1… |
CVE-2026-40196 | High | 8.1 | 2026-04-17 | HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned t… |
CVE-2026-27981 | High | 7.4 | 2026-03-03 | HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. I… |
CVE-2026-116680 | Medium | 6.4 | 2026-10-27 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation… |
CVE-2026-48974 | Medium | 5.4 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a c… |
CVE-2026-27600 | Medium | 5.0 | 2026-03-03 | HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to w… |
CVE-2026-26272 | Medium | 4.6 | 2026-03-03 | HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment uplo… |
CVE-2026-55473 | | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend… | |
CVE-2025-53108 | | 2025-07-02 | HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updat… |