Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: heymrun heym 0.0.105 Clear all filters
TI-2026-64999 CVE-2026-100861 · GHSA-77h5-29x8-rvxj

heym before 0.0.105 SSRF via credential-controlled base URLs

Priority MEDIUM 57

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-09-27 Fixed in 0.0.105 CWE-918
TI-2026-64998 CVE-2026-100860 · GHSA-v44j-74xg-9j2q

heym before 0.0.105 Authentication Bypass via Redis Node

Priority MEDIUM 63

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py).

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00226 Published 2026-09-27 Fixed in 0.0.105 CWE-636