Home-assistant vulnerabilities
28 CVEs and advisories name Home-assistant as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-91129Home Assistant: mDNS Server-Side Request Forgery
- CVE-2026-91130Home Assistant: XSS in Statistics Graph Card
- CVE-2026-66061Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
- CVE-2026-66060Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
- CVE-2026-59717Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
- CVE-2026-64825Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
- CVE-2026-64824Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
- CVE-2026-64823Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
- CVE-2026-55844Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
- CVE-2026-54318Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
- CVE-2026-54317Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2026-44698Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
- CVE-2021-47942Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
- CVE-2026-34205Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode
- CVE-2026-33045Home Assistant has stored XSS in history-graphs
- CVE-2026-33044Home Assistant has stored XSS in Map-card through malicious device name
- CVE-2025-62172Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name
- CVE-2025-25305SSL validation for outgoing requests in Home Assistant Core and used libs not correct
- CVE-2023-50715User accounts disclosed to unauthenticated actors on the LAN
- CVE-2023-41893Account takeover via auth_callback login in Home Assistant Core
- CVE-2023-41894Local-only webhooks externally accessible via SniTun in Home Assistant Core
- CVE-2023-41895Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41896Fake websocket server installation permits full takeover in Home Assistant Core
- CVE-2023-41897Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2023-41899Partial Server-Side Request Forgery in Home Assistant Core
- CVE-2023-41898 Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
- CVE-2023-44385Client-Side Request Forgery in Home Assistant iOS/macOS native Apps
- CVE-2023-27482homeassistant is an open source home automation tool.