Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

homeassistant

12 known vulnerabilities (2 critical, 5 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
2026.11.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
2026.11.0 (Nov 4, 2026), the latest release
Advisories
12 · 2 critical, 5 high, 4 medium
Weekly downloads
313.7K
Dependents
6
Releases
500+ since 2023.9.2 (Sep 13, 2023)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-91129
    Affects 2023.9.2 to 2026.2.2 (2026.2.3 is outside it)
  • CVE-2026-91130
    Affects 2023.9.2 to 2026.7.0b4 (2026.7.0 is outside it)
  • CVE-2026-64825
    Affects 2023.9.2 to 2026.6.0b4 (2026.6.0 is outside it)
  • CVE-2026-54317
    Affects 2023.9.2 to 2026.6.0b4 (2026.6.0 is outside it)
  • CVE-2026-33045
    Affects 2025.2.0 to 2026.1.0b5 (2026.1.0 is outside it)
  • CVE-2026-33044
    Affects 2023.9.2 to 2026.1.0b5 (2026.1.0 is outside it)
  • CVE-2025-65713
    Affects 2023.9.2 to 2025.8.0b5 (2025.8.0 is outside it)
  • CVE-2025-62172
    Affects 2025.1.0 to 2025.10.1 (2025.10.2 is outside it)
  • CVE-2025-25305
    Affects 2023.9.2 to 2024.1.5 (2024.1.6 is outside it)
  • CVE-2023-50715
    Affects 2023.9.2 to 2023.12.2 (2023.12.3 is outside it)
  • CVE-2023-41893
    No published release is affected
    No published release is affected
  • CVE-2018-21019
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 12

  • CVE-2026-91129Medium 5.4

    Home Assistant: mDNS Server-Side Request Forgery

    Affected: fixed in 2026.2.3.

    Fixed in 2026.2.3 (released Feb 20, 2026, 214 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • CVE-2026-91130Critical 9.3

    Home Assistant: XSS in Statistics Graph Card

    Affected: fixed in 2026.7.0.

    Fixed in 2026.7.0 (released Jul 1, 2026, 83 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • CVE-2026-64825Critical 9.0

    Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

    Affected: fixed in 2026.6.0.

    Fixed in 2026.6.0 (released Jun 3, 2026, 48 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

    Affected: fixed in 2026.6.0.

    Fixed in 2026.6.0 (released Jun 3, 2026, 20 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • Home Assistant has stored XSS in history-graphs

    Affected: from 2025.02, fixed in 2026.01.

    Fixed in 2026.1.0 (released Jan 7, 2026, 79 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • Home Assistant has stored XSS in Map-card through malicious device name

    Affected: from 2020.02, fixed in 2026.01.

    Fixed in 2026.1.0 (released Jan 7, 2026, 79 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • CVE-2025-65713Medium 4.0

    Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal.

    Affected: fixed in 2025.8.0.

    Fixed in 2025.8.0 (released Aug 6, 2025, 139 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name

    Affected: from 2025.1.0, fixed in 2025.10.2.

    Fixed in 2025.10.2 (released Oct 10, 2025, 4 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • SSL validation for outgoing requests in Home Assistant Core and used libs not correct

    Affected: fixed in 2024.1.6.

    Fixed in 2024.1.6 (released Jan 31, 2024, 384 days before disclosure).

    The latest release, 2026.11.0, is not affected.

  • CVE-2023-50715Medium 4.3

    User accounts disclosed to unauthenticated actors on the LAN

    Affected: fixed in 2023.12.3.

    Fixed in 2023.12.3 (released Dec 14, 2023, 1 day before disclosure).

    The latest release, 2026.11.0, is not affected.

  • CVE-2023-41893Medium 4.3

    Account takeover via auth_callback login in Home Assistant Core

    Affected: fixed in 2023.9.0.

    Fixed in 2023.9.0.

    The latest release, 2026.11.0, is not affected.

  • Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the…

    Affected: fixed in 0.67.0.

    Fixed in 0.67.0.

    The latest release, 2026.11.0, is not affected.