Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2026-100861

heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service responses returned as workflow node output.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym
CVE-2026-84207

Heym before 0.0.98 SSRF via WebSocket endpoints

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym
CVE-2026-45225

Heym < 0.0.21 Path Traversal File Upload via upload_file()

Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym
CVE-2026-45227

Heym < 0.0.21 Sandbox Escape via Python Introspection

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host commands as the backend service user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym
CVE-2026-45226

Heym < 0.0.21 Authorization Bypass in Workflow Execution

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Heymrun
Products
Heym