Homarr-labs vulnerabilities
We track 3 vulnerabilities in Homarr-labs products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 6, 2026.
Latest Homarr-labs vulnerabilities
- 8.8 High severity
homarr: Improper Neutralization of Alternate XSS Syntax
Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.
- 7.5 High severity
homarr: Exposure of Sensitive Information to an Unauthorized Actor
Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive in
- 9.0 Critical severity
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input…
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could im