Advisories · Technology
homarr.
Every CVE that names homarr among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
DOM-Based XSS in Homarr /auth/login Redirect
- homarr
- Cross-site scripting (XSS)
- Open redirect
- CVSS 4.2 Medium
Homarr has a Race Condition in Invite Token Registration (TOCTOU)
- homarr
- Race condition
- CVSS 5.3 Medium
Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
- homarr
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
Homarr: Unauthenticated SSRF in rssFeed.ts
- homarr
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
- homarr
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Homarr: missing input sanitization and possible privilege escalation through ldap search query injection
- homarr
- Other injection
- CWE-20
- CVSS 8.1 High
Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload
- homarr
- Unrestricted file upload
- CWE-20