Threat database

5 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Low	3.4	EPSS 0.2%	CVE-2026-107449Heimdall · Server-Side Request Forgery (SSRF) Low3.4EPSS 0.2%2026-10-08CVE Database V5CVE-2026-107449 linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data. EPSS 0.2%Vulnerability linuxserver #cwe-918 #ghsa-hrj5-rw8j-34qj	CVE Database V5	2026-10-08
High	7.5	EPSS 0.3%	CVE-2026-102387Xserver Migrator · Exposure of Sensitive System Information to an Unauthorized Control Sphere High7.5EPSS 0.3%2026-10-06CVE Database V5CVE-2026-102387 Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. EPSS 0.3%Vulnerability XServer #cwe-497	CVE Database V5	2026-10-06
High	8.1	EPSS 0.5%	CVE-2026-42411CloudSecure WP Security · Authentication Bypass Using an Alternate Path or Channel High8.1EPSS 0.5%2026-06-15CVE Database V5CVE-2026-42411 Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions. EPSS 0.5%Vulnerability XServer #cwe-288	CVE Database V5	2026-06-15
High	7.2	EPSS 0.6%	CVE-2025-54597Heimdall · Cross-site Scripting High7.2EPSS 0.6%2025-07-27CVE Database V5CVE-2025-54597 LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. EPSS 0.6%Vulnerability LinuxServer #cwe-79	CVE Database V5	2025-07-27
Medium	5.3	EPSS 0.4%	CVE-2024-43120TypeSquare Webfonts · Missing Authorization Medium5.3EPSS 0.4%2024-11-01CVE Database V5CVE-2024-43120 Missing Authorization vulnerability in XSERVER Inc. TypeSquare Webfonts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TypeSquare Webfonts: from n/a through 2.0.7. EPSS 0.4%Vulnerability XSERVER Inc.#cwe-862	CVE Database V5	2024-11-01

Showing 1–5 of 5 results