Known Vulnerabilities for Heym by Heymrun
Listed below are 10 of the newest known vulnerabilities associated with "Heym" by "Heymrun".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-110873 json | Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a... | Not Provided | 2026-10-14 | 2026-10-16 |
| CVE-2026-109362 json | Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing... | Not Provided | 2026-10-12 | 2026-10-15 |
| CVE-2026-105396 json | Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers ... | Not Provided | 2026-10-05 | 2026-10-05 |
| CVE-2026-101050 json | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_i... | Not Provided | 2026-09-27 | 2026-09-28 |
| CVE-2026-101049 json | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secr... | Not Provided | 2026-09-27 | 2026-09-28 |
| CVE-2026-100865 json | Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflo... | Not Provided | 2026-09-27 | 2026-09-28 |
| CVE-2026-100864 json | heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolve... | Not Provided | 2026-09-27 | 2026-09-28 |
| CVE-2026-100863 json | Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/... | Not Provided | 2026-09-27 | 2026-09-30 |
| CVE-2026-100862 json | heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91... | Not Provided | 2026-09-27 | 2026-09-30 |
| CVE-2026-100861 json | heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing aut... | Not Provided | 2026-09-27 | 2026-09-28 |