homarr
v2.13.1A modern and easy to use dashboard. 80+ integrations. 20K+ icons built in. Authentication out of the box. No YAML, drag and drop configuration.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 9 advisories4 high, 4 medium, 1 low
- Supported versions
- No scheduleendoflife.date does not track this project
5.4k stars · 368 forks · 123 open issues · last release 1 day ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 9 most recent advisories published by the maintainers: 4 high, 4 medium, 1 low. Check the patched version against the one you run.
- highCVE-2026-33510Apr 3, 2026DOM-Based XSS in Homarr /auth/login Redirect
- Affected
- <= 1.56.1
- Patched in
- >= 1.57.0
- mediumCVE-2026-32602Apr 3, 2026Race Condition in Invite Token Registration (TOCTOU)
- Affected
- <= 1.56.1
- Patched in
- >= 1.57.0
- mediumCVE-2026-27796Mar 6, 2026Unauthenticated Information Disclosure (Integration Metadata Leak)
- Affected
- <= 1.53.2
- mediumCVE-2026-27797Mar 6, 2026Unauthenticated SSRF in rssFeed.ts
- Affected
- <= 1.53.2
- Patched in
- >= 1.54.0
- mediumCVE-2026-25123Feb 6, 2026Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
- Affected
- <= 1.51.0
- Patched in
- >= 1.52.0
- highCVE-2025-67493Dec 17, 2025Missing input sanitization and possible privilege escalation through ldap search query injection
- Affected
- <=1.45.2
- Patched in
- >=1.45.3
- highCVE-2025-64759Nov 19, 2025Stored Cross-Site Scripting (XSS) and possible Privilege Escalation via Malicious SVG Upload
- Affected
- <=1.43.2
- Patched in
- >= 1.43.3
- highCVE-2025-54313Jul 21, 2025Hijaked upstream library
- Affected
- 1.29.0; 1.29.1
- Patched in
- 1.30.0
- lowGHSA-pxx9-3wm2-4r56Apr 9, 2025Any signed in user can modify content of Notebook widget
- Affected
- < 1.15.0
- Patched in
- 1.15.0