esphome vulnerabilities
10 published CVEs name esphome among the affected products.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-59177
ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
esphome · device-builder
High8.8 - CVE-2026-59178
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
esphome · device-builder
Critical9.8 - CVE-2026-71260
ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
esphome · esphome
Medium6.5 - CVE-2026-71259
ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
esphome · esphome
High8.6 - CVE-2026-23833
ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
esphome · esphome
Low1.7 - CVE-2025-57808
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
esphome · esphome
High8.1 - CVE-2024-29019
ESPHome vulnerable to Authentication bypass via Cross site request forgery
esphome · esphome
High8.1 - CVE-2024-27287
ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API
esphome · esphome
Medium6.5 - CVE-2024-27081
ESPHome remote code execution via arbitrary file write
esphome · esphome
High7.2 - CVE-2021-41104
web_server allows OTA update without checking user defined basic auth username & password
esphome · esphome
High7.5