LinuxServer Heimdall

• CVE-2026-107449 Low 3.4 linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute() 0.2%
• CVE-2025-54597 High 7.2 LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. 0.6%