# cve.now: Home-assistant

The newest entries naming Home-assistant as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-91129](https://cve.now/CVE-2026-91129.md): Home Assistant: mDNS Server-Side Request Forgery (CVSS 5.4)
- [CVE-2026-91130](https://cve.now/CVE-2026-91130.md): Home Assistant: XSS in Statistics Graph Card (CVSS 9.3)
- [CVE-2026-66061](https://cve.now/CVE-2026-66061.md): Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution (CVSS 7.1)
- [CVE-2026-66060](https://cve.now/CVE-2026-66060.md): Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers (CVSS 7.1)
- [CVE-2026-59717](https://cve.now/CVE-2026-59717.md): Home Assistant Companion: \`homeassistant://invite\` Deep Link Credential Phishing (CVSS 4.3)
- [CVE-2026-64825](https://cve.now/CVE-2026-64825.md): Home Assistant Core \< 2026.6.0 Path Traversal File Write via Backup Upload (CVSS 9.0)
- [CVE-2026-64824](https://cve.now/CVE-2026-64824.md): Home Assistant Core \< 2026.7.0 Symlink Path Traversal RCE via backup-restore (CVSS 9.3)
- [CVE-2026-64823](https://cve.now/CVE-2026-64823.md): Home Assistant Core \< 2026.5.4 XSS via Shelly media\_player.py thumb URI (CVSS 2.1)
- [CVE-2026-55844](https://cve.now/CVE-2026-55844.md): Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data (CVSS 7.5)
- [CVE-2026-54318](https://cve.now/CVE-2026-54318.md): Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location (CVSS 7.1)
- [CVE-2026-54317](https://cve.now/CVE-2026-54317.md): Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN (CVSS 7.6)
- [CVE-2026-44698](https://cve.now/CVE-2026-44698.md): Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection (CVSS 8.3)
- [CVE-2021-47942](https://cve.now/CVE-2021-47942.md): Home Assistant Community Store 1.10.0 Path Traversal Account Takeover (CVSS 8.7)
- [CVE-2026-34205](https://cve.now/CVE-2026-34205.md): Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode (CVSS 9.7)
- [CVE-2026-33045](https://cve.now/CVE-2026-33045.md): Home Assistant has stored XSS in history-graphs (CVSS 7.3)
- [CVE-2026-33044](https://cve.now/CVE-2026-33044.md): Home Assistant has stored XSS in Map-card through malicious device name (CVSS 7.3)
- [CVE-2025-62172](https://cve.now/CVE-2025-62172.md): Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name (CVSS 8.5)
- [CVE-2025-25305](https://cve.now/CVE-2025-25305.md): SSL validation for outgoing requests in Home Assistant Core and used libs not correct (CVSS 7.0)
- [CVE-2023-50715](https://cve.now/CVE-2023-50715.md): User accounts disclosed to unauthenticated actors on the LAN (CVSS 4.3)
- [CVE-2023-41893](https://cve.now/CVE-2023-41893.md): Account takeover via auth\_callback login in Home Assistant Core (CVSS 4.3)
- [CVE-2023-41894](https://cve.now/CVE-2023-41894.md): Local-only webhooks externally accessible via SniTun in Home Assistant Core (CVSS 5.3)
- [CVE-2023-41895](https://cve.now/CVE-2023-41895.md): Cross-site Scripting via auth\_callback login in Home Assistant Core (CVSS 8.8)
- [CVE-2023-41896](https://cve.now/CVE-2023-41896.md): Fake websocket server installation permits full takeover in Home Assistant Core (CVSS 7.1)
- [CVE-2023-41897](https://cve.now/CVE-2023-41897.md): Lack of XFO header allows clickjacking in Home Assistant Core (CVSS 8.8)
- [CVE-2023-41899](https://cve.now/CVE-2023-41899.md): Partial Server-Side Request Forgery in Home Assistant Core (CVSS 6.6)
- [CVE-2023-41898](https://cve.now/CVE-2023-41898.md): Arbitrary URL load in Android WebView in \`MyActivity.kt\` in Home Assistant Companion for Android (CVSS 8.6)
- [CVE-2023-44385](https://cve.now/CVE-2023-44385.md): Client-Side Request Forgery in Home Assistant iOS/macOS native Apps (CVSS 8.6)
- [CVE-2023-27482](https://cve.now/CVE-2023-27482.md): homeassistant is an open source home automation tool. (CVSS 10.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/home-assistant
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.