Log in Start free

Home Assistant

Products

ProductCVEsExploitedLatest
core23–Sep 22, 2026
Home Assistant Core3–Jul 21, 2026
Home Assistant Community Store (HACS)1–May 16, 2026
Home Assistant Operating System1–Mar 27, 2026
Home Assistant Supervisor1–Mar 27, 2026
Companion app (Android)1–May 29, 2026
supervisor1–Mar 8, 2023
Companion app (iOS)1–May 29, 2026

Exploited and recent CVEs

  • CVE-2026-91129 Medium 5.4 Home Assistant: mDNS Server-Side Request Forgery 0.3%
  • CVE-2026-91130 Critical 9.3 Home Assistant: XSS in Statistics Graph Card 0.5%
  • CVE-2026-66061 High 7.1 Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution 0.2%
  • CVE-2026-66060 High 7.1 Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers 0.2%
  • CVE-2026-59717 Medium 4.3 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing 0.4%
  • CVE-2026-64825 Critical 9.3 Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload 0.6%
  • CVE-2026-64824 High 8.4 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore 0.7%
  • CVE-2026-64823 Medium 4.7 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI 0.3%
  • CVE-2026-55844 High 7.5 Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data 0.2%
  • CVE-2026-54318 High 7.1 Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location 0.2%
  • CVE-2026-54317 High 7.6 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN 0.3%
  • CVE-2026-44698 High 8.3 Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection 0.1%
  • CVE-2026-44698 High 8.3 Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection 0.1%
  • CVE-2026-44698 High 8.3 Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection 0.1%
  • CVE-2021-47942 High 7.5 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover 0.5%
  • CVE-2026-34205 Critical 9.7 Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode 0.3%
  • CVE-2026-34205 Critical 9.7 Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode 0.3%
  • CVE-2026-33045 High 7.3 Home Assistant has stored XSS in history-graphs 0.2%
  • CVE-2026-33044 High 7.3 Home Assistant has stored XSS in Map-card through malicious device name 0.2%
  • CVE-2025-62172 High 8.5 Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name 0.4%
  • CVE-2025-25305 High 7.0 SSL validation for outgoing requests in Home Assistant Core and used libs not correct 0.2%
  • CVE-2023-50715 Medium 4.3 User accounts disclosed to unauthenticated actors on the LAN 0.9%
  • CVE-2023-41893 Medium 4.3 Account takeover via auth_callback login in Home Assistant Core 0.5%
  • CVE-2023-41894 Medium 5.3 Local-only webhooks externally accessible via SniTun in Home Assistant Core 0.5%
  • CVE-2023-41895 High 8.8 Cross-site Scripting via auth_callback login in Home Assistant Core 0.7%
  • CVE-2023-41896 High 7.1 Fake websocket server installation permits full takeover in Home Assistant Core 0.3%
  • CVE-2023-41897 High 8.8 Lack of XFO header allows clickjacking in Home Assistant Core 1.1%
  • CVE-2023-41899 Medium 6.6 Partial Server-Side Request Forgery in Home Assistant Core 0.6%
  • CVE-2023-41898 High 8.6 Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android 0.2%
  • CVE-2023-44385 High 8.6 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps 0.3%