HO
Product
homarr
7
CVEs
0
On KEV
9.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 4Low 0
Watch
Add homarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67493 | 9.0 | Dec 17 | Homarr: missing input sanitization and possible privilege escalation through ldap search query injection Affected: < 1.45.3 |
| CVE-2026-33510 | 8.8 | Apr 6 | DOM-Based XSS in Homarr /auth/login Redirect Affected: < 1.57.0 |
| CVE-2026-27796 | 7.5 | Mar 7 | Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) Affected: < 1.54.0 |
| CVE-2025-64759 | 6.1 | Nov 19 | Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload Affected: < 1.43.3 |
| CVE-2026-27797 | 5.3 | Mar 7 | Homarr: Unauthenticated SSRF in rssFeed.ts Affected: < 1.54.0 |
| CVE-2026-25123 | 5.3 | Feb 6 | Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping Affected: < 1.52.0 |
| CVE-2026-32602 | 4.2 | Apr 6 | Homarr has a Race Condition in Invite Token Registration (TOCTOU) Affected: < 1.57.0 |
Showing 7