LI
Vendor
Linuxserver
6
CVEs
0
On KEV
1
New 30D
Products
HE6.1
Heimdall
linuxserver
2 CVEs0 on KEV1 new
HA9.8
Heimdall Application Dashboard
Linuxserver
3 CVEs0 on KEV0 new
DO9.8
Docker-heimdall
Linuxserver
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107449 | HE Heimdall linuxserver | 3.4 | Oct 8 | linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via… |
| CVE-2025-50578 | DO Docker-heimdall Linuxserver | 9.8 | Jul 30 | LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer` |
| CVE-2025-54597 | HE Heimdall LinuxServer | 6.1 | Jul 27 | LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter |
| CVE-2024-51358 | HA Heimdall Application Dashboard Linuxserver | 9.8 | Nov 5 | An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application |
| CVE-2022-47968 | HA Heimdall Application Dashboard Linuxserver | 5.4 | Dec 27 | Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page |