Icewhaletech vulnerabilities

Products

• Zimaos 12
• Casaos-userservice 5
• Casaos 2

Newest

• icewhaletech zimaos Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS CVE-2026-28798 9.1 CriticalApril 3, 2026
• icewhaletech zimaos ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation CVE-2026-28442 8.6 HighMarch 5, 2026
• icewhaletech zimaos ZimaOS is vulnerable to Server-Side Request Forgery (SSRF) CVE-2025-64427 7.1 HighMarch 2, 2026
• icewhaletech zimaos ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API CVE-2026-28286 Public exploit 8.6 HighMarch 2, 2026
• icewhaletech zimaos ZimaOS has Authentication Bypass via System-Level Username CVE-2026-21891 9.4 CriticalJanuary 8, 2026
• icewhaletech zimaos ZimaOS Privilege Escalation using localhost calls to File API Upload CVE-2025-58432 5.2 MediumSeptember 17, 2025
• icewhaletech zimaos ZimaOS reads arbitrary files using localhost calls to File API Download CVE-2025-58431 4.8 MediumSeptember 17, 2025
• icewhaletech zimaos ZimaOS vulnerable to Directory Listing via Parameter Manipulation CVE-2024-49359 7.5 HighOctober 24, 2024
• icewhaletech zimaos ZimaOS vulnerable to Username Enumeration via API Responses CVE-2024-49358 5.3 MediumOctober 24, 2024
• icewhaletech zimaos ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak CVE-2024-49357 EPSS 23.7% 7.5 HighOctober 24, 2024
• icewhaletech zimaos ZimaOS Unauthenticated API Discloses Usernames CVE-2024-48932 5.3 MediumOctober 24, 2024
• icewhaletech zimaos ZimaOS Arbitrary File Read via Parameter Manipulation CVE-2024-48931 7.5 HighOctober 24, 2024
• icewhale casaos-userservice Username Enumeration in CasaOS via bypass of CVE-2024-24766 CVE-2024-28232 Fix available 6.2 MediumApril 1, 2024
• icewhale casaos, icewhaletech casaos-userservice +1 more CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability CVE-2024-24767 Fix available 9.1 CriticalMarch 6, 2024
• icewhale casaos-userservice CasaOS Username Enumeration CVE-2024-24766 Fix available 6.2 MediumMarch 6, 2024
• icewhale casaos, icewhaletech casaos-userservice +1 more CasaOS-UserService allows unauthorized access to any file CVE-2024-24765 Fix available 7.5 HighMarch 6, 2024
• icewhale casaos, icewhaletech casaos-userservice +1 more CasaOS Command Injection vulnerability CVE-2023-37469 Fix available 8.8 HighAugust 24, 2023
• icewhale casaos Weak json web token (JWT) secrets in CasaOS CVE-2023-37266 Fix available 9.8 CriticalJuly 17, 2023
• icewhale casaos, casaos-gateway +1 more Incorrect identification of source IP addresses in CasaOS CVE-2023-37265 Fix available 9.8 CriticalJuly 17, 2023