Skip to content
Home-assistant vulnerabilities
Newest
-
home-assistant core
Home Assistant: mDNS Server-Side Request Forgery
CVE-2026-91129
Fix available
5.4 Medium
-
home-assistant core
Home Assistant: XSS in Statistics Graph Card
CVE-2026-91130
Fix available
9.3 Critical
-
home-assistant core
Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
CVE-2026-66061
7.1 High
-
home-assistant core
Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
CVE-2026-66060
7.1 High
-
home-assistant core
Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
CVE-2026-59717
4.3 Medium
-
home-assistant home assistant core
Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
CVE-2026-64825
Fix available
9.0 Critical
-
home-assistant home assistant core
Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
CVE-2026-64823
2.1 Low
-
home-assistant core
Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
CVE-2026-55844
7.5 High
-
home-assistant core, home assistant companion +1 more
Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
CVE-2026-54318
7.1 High
-
home-assistant core, home-assistant +1 more
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
CVE-2026-54317
Fix available
7.6 High
-
home-assistant home assistant core
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
CVE-2026-64824
Public exploit
9.3 Critical
-
home assistant companion app (android), companion app (ios), home-assistant core +2 more
Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
CVE-2026-44698
8.3 High
-
hacs home assistant community store, home-assistant home assistant community store (hacs) +1 more
Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
CVE-2021-47942
8.7 High
-
home-assistant home assistant supervisor, home assistant operating system +1 more
Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode
CVE-2026-34205
9.7 Critical
-
home-assistant core, home-assistant +1 more
Home Assistant has stored XSS in history-graphs
CVE-2026-33045
Fix available
7.3 High
-
home-assistant core, home-assistant +1 more
Home Assistant has stored XSS in Map-card through malicious device name
CVE-2026-33044
Fix available
7.3 High
-
home-assistant
Home Assistant Core before is vulnerable to Directory Traversal
CVE-2025-65713
Fix available
4.0 Medium
-
home-assistant core
Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name
CVE-2025-62172
Fix available
8.5 High
-
home-assistant core
SSL validation for outgoing requests in Home Assistant Core and used libs not correct
CVE-2025-25305
Fix available
7.0 High
-
home-assistant core, home-assistant +1 more
User accounts disclosed to unauthenticated actors on the LAN
CVE-2023-50715
Fix available
4.3 Medium
-
home-assistant core, home-assistant +1 more
Account takeover via auth_callback login in Home Assistant Core
CVE-2023-41893
Fix available
4.3 Medium
-
home-assistant core, home-assistant +1 more
Local-only webhooks externally accessible via SniTun in Home Assistant Core
CVE-2023-41894
5.3 Medium
-
home-assistant core, home-assistant +1 more
Cross-site Scripting via auth_callback login in Home Assistant Core
CVE-2023-41895
8.8 High
-
home-assistant core, home-assistant, home-assistant home-assistant-js-websocket +2 more
Fake websocket server installation permits full takeover in Home Assistant Core
CVE-2023-41896
7.1 High
-
home-assistant core, home-assistant +1 more
Lack of XFO header allows clickjacking in Home Assistant Core
CVE-2023-41897
8.8 High
-
home-assistant core, home-assistant +1 more
Partial Server-Side Request Forgery in Home Assistant Core
CVE-2023-41899
6.6 Medium
-
home-assistant home assistant companion, core +1 more
Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
CVE-2023-41898
Public exploit
8.6 High
-
home-assistant home assistant companion, core +1 more
Client-Side Request Forgery in Home Assistant iOS/macOS native Apps
CVE-2023-44385
8.6 High
-
home-assistant core, supervisor, home-assistant +2 more
CVE-2023-27482 in supervisor - Patched by Root
CVE-2023-27482
Fix available
EPSS 72.2%
10.0 Critical
-
home-assistant
An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised...
CVE-2020-36517
7.5 High
-
home-assistant
** DISPUTED ** Home Assistant before 2021.1.3 does not have a protection layer that can help to...
CVE-2021-3152
Disputed
5.3 Medium
-
home-assistant
Home Assistant information disclosure vulnerability
CVE-2018-21019
Fix available
7.5 High
-
home-assistant
Withdrawn Advisory: Home Assistant Frontend XSS Vulnerability
CVE-2017-16782
6.1 Medium