CVE-2026-27796 Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service...

homarr 代码问题漏洞

Homarr is a customizable browser homepage developed by Thomas Camlong, used to interact with the Docker container of the main server. Versions of Homarr prior to 1.54.0 have code vulnerabilities due to unvalidated server-side request forgery attacks. These vulnerabilities could allow remote...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2025-64759 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an...

CVE-2025-64759

CVE-2025-64759 affects Homarr before version 1.43.3, where a stored XSS flaw allows executing arbitrary JavaScript in a user’s browser via a malicious uploaded SVG. If an administrator views the page rendering or redirecting to the SVG, an attacker could add their account to the "credentials-admi...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2023-45908

CVE-2023-45908 affects Homarr prior to v0.14.0, with a stored XSS vulnerability via the Notebook widget. The issue is described consistently across sources (NVD/Red Hat/CNNVD/OSV, etc.) as a stored XSS in the Notebook widget that could impact user-provided content; CVSS v3.1 base score 6.1 (Mediu...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...