Skip to content
Home-assistant Core vulnerabilities
-
home-assistant core
Home Assistant: mDNS Server-Side Request Forgery
CVE-2026-91129
Fix available
5.4 Medium
-
home-assistant core
Home Assistant: XSS in Statistics Graph Card
CVE-2026-91130
Fix available
9.3 Critical
-
home-assistant core
Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
CVE-2026-66061
7.1 High
-
home-assistant core
Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
CVE-2026-66060
7.1 High
-
home-assistant core
Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
CVE-2026-59717
4.3 Medium
-
home-assistant home assistant core
Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
CVE-2026-64825
Fix available
9.0 Critical
-
home-assistant home assistant core
Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
CVE-2026-64823
2.1 Low
-
home-assistant core
Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
CVE-2026-55844
7.5 High
-
home-assistant core, home assistant companion +1 more
Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
CVE-2026-54318
7.1 High
-
home-assistant core, home-assistant +1 more
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
CVE-2026-54317
Fix available
7.6 High
-
home-assistant home assistant core
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
CVE-2026-64824
Public exploit
9.3 Critical
-
home assistant companion app (android), companion app (ios), home-assistant core +2 more
Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
CVE-2026-44698
8.3 High
-
home-assistant core, home-assistant +1 more
Home Assistant has stored XSS in history-graphs
CVE-2026-33045
Fix available
7.3 High
-
home-assistant core, home-assistant +1 more
Home Assistant has stored XSS in Map-card through malicious device name
CVE-2026-33044
Fix available
7.3 High
-
home-assistant core
Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name
CVE-2025-62172
Fix available
8.5 High
-
home-assistant core
SSL validation for outgoing requests in Home Assistant Core and used libs not correct
CVE-2025-25305
Fix available
7.0 High
-
home-assistant core, home-assistant +1 more
User accounts disclosed to unauthenticated actors on the LAN
CVE-2023-50715
Fix available
4.3 Medium
-
home-assistant core, home-assistant +1 more
Account takeover via auth_callback login in Home Assistant Core
CVE-2023-41893
Fix available
4.3 Medium
-
home-assistant core, home-assistant +1 more
Local-only webhooks externally accessible via SniTun in Home Assistant Core
CVE-2023-41894
5.3 Medium
-
home-assistant core, home-assistant +1 more
Cross-site Scripting via auth_callback login in Home Assistant Core
CVE-2023-41895
8.8 High
-
home-assistant core, home-assistant, home-assistant home-assistant-js-websocket +2 more
Fake websocket server installation permits full takeover in Home Assistant Core
CVE-2023-41896
7.1 High
-
home-assistant core, home-assistant +1 more
Lack of XFO header allows clickjacking in Home Assistant Core
CVE-2023-41897
8.8 High
-
home-assistant core, home-assistant +1 more
Partial Server-Side Request Forgery in Home Assistant Core
CVE-2023-41899
6.6 Medium
-
home-assistant home assistant companion, core +1 more
Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
CVE-2023-41898
Public exploit
8.6 High
-
home-assistant home assistant companion, core +1 more
Client-Side Request Forgery in Home Assistant iOS/macOS native Apps
CVE-2023-44385
8.6 High
-
home-assistant core, supervisor, home-assistant +2 more
CVE-2023-27482 in supervisor - Patched by Root
CVE-2023-27482
Fix available
EPSS 72.2%
10.0 Critical