Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Runtipi

First CVE: Jan 22, 2026Active for: 1 yearTotal CVEs: 4

Runtipi is a modestly represented self-hosting platform that enables users to deploy and manage applications on personal infrastructure, with its vulnerability footprint concentrated in authentication and access-control weaknesses including missing authentication for critical functions, improper rate limiting, path traversal, OS command injection, and excessive authentication-attempt tolerance. These classes reflect the inherent risks of a user-facing, application-aggregation system where input validation and access boundaries are central to isolating tenant workloads and preventing lateral movement. Current severity, exploitation, and exposure counts are shown alongside this summary.

FAUCET AI Generated
4
Total CVEs
More Total CVEs than 79% of tracked vendors
4.0
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 95% of tracked vendors
9.1
Avg CVSS Score
Higher Avg CVSS Score than 88% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Runtipi over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jan 22, 2026
6 months ago
Most Recent CVE
Mar 13, 2026
135 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (4 CVEs).

4 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2026-32729HIGH
Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout m
Mar 13, 20268.830NONO
CVE-2026-31881CRITICAL
Runtipi is a personal homeserver orchestrator. Prior to 4.8.0, an unauthenticated attacker can reset the operator (admin) password when a password-reset request is active, resultin
Mar 11, 20269.829NONO
CVE-2026-24129HIGH
Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versions 3.7.0 and above allow an authenticated user to execute a
Jan 22, 20268.829NONO
CVE-2026-25116HIGH
Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the `UserConfigController` a
Jan 29, 20268.828NONO
View all 4 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products4 CVEs
75%
25%
Severity distribution among all CVEs352,719 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network4 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (75.0%)
Unknown0 (0.0%)
Required1 (25.0%)
Privileges Required
Low2 (50.0%)
High0 (0.0%)
None2 (50.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (4 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Runtipi.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Runtipi — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Runtipi's Products

View all 1 CNAs →

Top CWEs