home-assistant vulnerabilities
28 published CVEs name home-assistant among the affected products.
- 28Published CVEs28 of them scored
- 16Last 12 monthspublished in the last year
- 5Critical16 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
home-assistant · core
Medium5.4 - CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
home-assistant · core
Critical9.3 - CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
home-assistant · core
High7.1 - CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
home-assistant · core
High7.1 - CVE-2026-59717
Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
home-assistant · core
Medium4.3 - CVE-2026-64825
Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
home-assistant · Home Assistant Core
Critical9.0 - CVE-2026-64824
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
home-assistant · Home Assistant Core
Critical9.3 - CVE-2026-64823
Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
home-assistant · Home Assistant Core
Low2.1 - CVE-2026-55844
Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
home-assistant · core
High7.5 - CVE-2026-54318
Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
home-assistant · core
High7.1