Sipcapture vulnerabilities
We track 3 vulnerabilities in Sipcapture products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
Latest Sipcapture vulnerabilities
- 9.8 Critical severity
homer: Missing Authentication for Critical Functionality
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default
- 9.8 Critical severity
homer: Use of Hard-coded Credentials
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA
- 8.1 High severity
homer: Improper Neutralization of Special Elements used in an SQL Command
Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of