esphome

Products

Exploited and recent CVEs

• CVE-2026-59177 High 8.8 ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces 1.2%
• CVE-2026-59178 Critical 9.8 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade 0.8%
• CVE-2026-71260 Medium 6.5 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field 0.3%
• CVE-2026-71259 High 8.6 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution 0.2%
• CVE-2026-23833 Low 1.7 ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component 0.3%
• CVE-2025-57808 High 8.1 ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header 1.5%
• CVE-2024-29019 High 8.1 ESPHome vulnerable to Authentication bypass via Cross site request forgery 0.3%
• CVE-2024-27287 Medium 6.5 ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API 0.7%
• CVE-2024-27081 High 7.2 ESPHome remote code execution via arbitrary file write 1.5%
• CVE-2021-41104 High 7.5 web_server allows OTA update without checking user defined basic auth username & password 1.2%