Threat database

2 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Low	3.4	EPSS 0.2%	CVE-2026-107449Heimdall · Server-Side Request Forgery (SSRF) Low3.4EPSS 0.2%2026-10-08CVE Database V5CVE-2026-107449 linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data. EPSS 0.2%Vulnerability linuxserver #cwe-918 #ghsa-hrj5-rw8j-34qj	CVE Database V5	2026-10-08
High	7.2	EPSS 0.6%	CVE-2025-54597Heimdall · Cross-site Scripting High7.2EPSS 0.6%2025-07-27CVE Database V5CVE-2025-54597 LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. EPSS 0.6%Vulnerability LinuxServer #cwe-79 Germany+9	CVE Database V5	2025-07-27

Showing 1–2 of 2 results