HO
Product
Homarr
On CISA KEVExploited in the wild
8
CVEs
1
On KEV
9.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 4Low 0
Watch
Add Homarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54313 In wildKEV | 7.5 | Jul 19 | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability Affected: 1.29.0 before 1.30.0 |
| CVE-2025-67493 | 9.0 | Dec 17 | Homarr: missing input sanitization and possible privilege escalation through ldap search query injection Affected: before 1.45.3 |
| CVE-2026-33510 | 8.8 | Apr 6 | DOM-Based XSS in Homarr /auth/login Redirect Affected: before 1.57.0 |
| CVE-2026-27796 | 7.5 | Mar 7 | Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) Affected: before 1.54.0 |
| CVE-2025-64759 | 6.1 | Nov 19 | Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload Affected: before 1.43.3 |
| CVE-2026-27797 | 5.3 | Mar 7 | Homarr: Unauthenticated SSRF in rssFeed.ts Affected: before 1.54.0 |
| CVE-2026-25123 | 5.3 | Feb 6 | Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping Affected: before 1.52.0 |
| CVE-2026-32602 | 4.2 | Apr 6 | Homarr has a Race Condition in Invite Token Registration (TOCTOU) Affected: before 1.57.0 |
Showing 8