HO
Product
Homarr
On CISA KEVExploited in the wild
8
CVEs
1
On KEV
9.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 4Low 0
Watch
Add Homarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-64759 | 6.1 | Nov 19 | Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload Affected: before 1.43.3 |
| CVE-2026-27797 | 5.3 | Mar 7 | Homarr: Unauthenticated SSRF in rssFeed.ts Affected: before 1.54.0 |
| CVE-2026-25123 | 5.3 | Feb 6 | Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping Affected: before 1.52.0 |
| CVE-2026-32602 | 4.2 | Apr 6 | Homarr has a Race Condition in Invite Token Registration (TOCTOU) Affected: before 1.57.0 |
Showing 4