Vendors / LinuxServer Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 1
Exploited now LinuxServer records in CISA KEV No LinuxServer vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.031 · Published 2025-07-30 · No fix listed CWE-20
Priority MEDIUM 58
Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00432 · Published 2022-12-27 · No fix listed CWE-79
Priority MEDIUM 50
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp clien…
CVSS 3.1 LOW 3.4· Network · No auth · User interaction · EPSS 0.00162 · Published 2026-10-08 · No fix listed CWE-918
Priority LOW 39
LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
CVSS 3.1 HIGH 7.2· Network · No auth · No interaction · EPSS 0.00606 · Published 2025-07-27 · Fixed in 2.7.3 CWE-79
Open these records in search → All records by CVSS severity
1 1 1 1 0
THREATIST.IORead the docs