homarr-labs

Products

Exploited and recent CVEs

• CVE-2026-33510 High 8.8 DOM-Based XSS in Homarr /auth/login Redirect 0.2%
• CVE-2026-32602 Medium 4.2 Homarr has a Race Condition in Invite Token Registration (TOCTOU) 0.1%
• CVE-2026-27796 Medium 5.3 Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) 1.3%
• CVE-2026-27797 Medium 5.3 Homarr: Unauthenticated SSRF in rssFeed.ts 0.5%
• CVE-2026-25123 Medium 5.3 Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping 0.3%
• CVE-2025-67493 High 7.5 Homarr: missing input sanitization and possible privilege escalation through ldap search query injection 0.3%
• CVE-2025-64759 High 8.1 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload 0.3%