Homarr vulnerabilities

Products

• Homarr 8

Newest

• homarr DOM-Based XSS in Homarr /auth/login Redirect CVE-2026-33510 8.8 HighApril 6, 2026
• homarr Homarr has a Race Condition in Invite Token Registration (TOCTOU) CVE-2026-32602 4.2 MediumApril 6, 2026
• homarr Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) CVE-2026-27796 5.3 MediumMarch 7, 2026
• homarr Homarr: Unauthenticated SSRF in rssFeed.ts CVE-2026-27797 5.3 MediumMarch 7, 2026
• homarr Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping CVE-2026-25123 5.3 MediumFebruary 6, 2026
• homarr Homarr: missing input sanitization and possible privilege escalation through ldap search query injection CVE-2025-67493 7.5 HighDecember 17, 2025
• homarr Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload CVE-2025-64759 8.1 HighNovember 19, 2025
• prettier eslint-config-prettier, eslint-plugin-prettier, un-ts napi-postinstall +4 more +6 more eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code CVE-2025-54313 In KEVPublic exploitFix available 7.5 HighJuly 19, 2025