home-assistant core vulnerabilities
23 published CVEs name home-assistant core among the affected products.
- 23Published CVEs23 of them scored
- 11Last 12 monthspublished in the last year
- 2Critical15 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-91129
Home Assistant: mDNS Server-Side Request Forgery
home-assistant · core
Medium5.4 - CVE-2026-91130
Home Assistant: XSS in Statistics Graph Card
home-assistant · core
Critical9.3 - CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
home-assistant · core
High7.1 - CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
home-assistant · core
High7.1 - CVE-2026-59717
Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
home-assistant · core
Medium4.3 - CVE-2026-55844
Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
home-assistant · core
High7.5 - CVE-2026-54318
Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
home-assistant · core
High7.1 - CVE-2026-54317
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
home-assistant · core
High7.6 - CVE-2026-44698
Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
home-assistant · core
High8.3 - CVE-2026-33045
Home Assistant has stored XSS in history-graphs
home-assistant · core
High7.3