LinuxServer
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Heimdall | 2 | – | Oct 8, 2026 |
Exploited and recent CVEs
- CVE-2026-107449 linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute() 0.2%
- CVE-2025-54597 LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. 0.6%