HO
Vendor
Homarr
8
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-33510 | HO Homarr Homarr | 8.8 | Apr 6 | DOM-Based XSS in Homarr /auth/login Redirect |
| CVE-2026-32602 | HO Homarr Homarr | 4.2 | Apr 6 | Homarr has a Race Condition in Invite Token Registration (TOCTOU) |
| CVE-2026-27796 | HO Homarr Homarr | 7.5 | Mar 7 | Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) |
| CVE-2026-27797 | HO Homarr Homarr | 5.3 | Mar 7 | Homarr: Unauthenticated SSRF in rssFeed.ts |
| CVE-2026-25123 | HO Homarr Homarr | 5.3 | Feb 6 | Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping |
| CVE-2025-67493 | HO Homarr Homarr | 9.0 | Dec 17 | Homarr: missing input sanitization and possible privilege escalation through ldap search query injection |
| CVE-2025-64759 | HO Homarr Homarr | 6.1 | Nov 19 | Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload |
| CVE-2025-54313 In wildKEV | HO Homarr Homarr | 7.5 | Jul 19 | Prettier eslint-config-prettier Embedded Malicious Code Vulnerability |