TI-2026-22992 CVE-2026-28798
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS
Priority MEDIUM 43
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Vulnerabilities
21 records
TI-2026-22712 CVE-2026-28442
ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation
Priority HIGH 72
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Priority LOW 31
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
TI-2026-22593 CVE-2026-28286
ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
Priority MEDIUM 43
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Priority HIGH 82
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
TI-2025-24320 CVE-2025-34171 · GHSA-9w9c-6cc9-mc59
CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure
Priority LOW 38
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information.
Priority MEDIUM 57
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Priority MEDIUM 55
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Priority HIGH 74
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Priority MEDIUM 63
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
TI-2024-32945 CVE-2024-49357
ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak
Priority HIGH 72
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
TI-2024-32627 CVE-2024-48932
ZimaOS Unauthenticated API Discloses Usernames
Priority MEDIUM 63
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
Priority HIGH 74
ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.
TI-2024-18791 CVE-2024-28232 · GHSA-hcw2-2r9c-gc6p
Username Enumeration in CasaOS via bypass of CVE-2024-24766
Priority HIGH 66
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS.
TI-2024-16283 CVE-2024-24766 · GHSA-c967-2652-gfjm
CasaOS Username Enumeration
Priority HIGH 66
CasaOS-UserService provides user management functionalities to CasaOS.
TI-2024-16284 CVE-2024-24767 · GHSA-c69x-5xmw-v44x
CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability
Priority HIGH 82
CasaOS-UserService provides user management functionalities to CasaOS.
TI-2024-16282 CVE-2024-24765 · GHSA-h5gf-cmm8-cg7c
CasaOS-UserService allows unauthorized access to any file
Priority HIGH 76
CasaOS-UserService provides user management functionalities to CasaOS.
TI-2023-19077 CVE-2023-37469 · GHSA-92vc-4fcw-g68q
CasaOS Command Injection vulnerability
Priority HIGH 73
CasaOS is an open-source personal cloud system.
TI-2023-18895 CVE-2023-37265 · GHSA-vjh7-5r6x-xh6g
Incorrect identification of source IP addresses in CasaOS
Priority MEDIUM 59
CasaOS is an open-source Personal Cloud system.
TI-2023-18896 CVE-2023-37266 · GHSA-m5q5-8mfw-p2hr
Weak json web token (JWT) secrets in CasaOS
Priority MEDIUM 59
CasaOS is an open-source Personal Cloud system.
TI-2022-08122 CVE-2022-24193 · GHSA-jh63-28gx-7p26
CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.
Priority MEDIUM 50
CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.