Home Assistant core

• CVE-2026-91129 Medium 5.4 Home Assistant: mDNS Server-Side Request Forgery 0.3%
• CVE-2026-91130 Critical 9.3 Home Assistant: XSS in Statistics Graph Card 0.5%
• CVE-2026-66061 High 7.1 Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution 0.2%
• CVE-2026-66060 High 7.1 Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers 0.2%
• CVE-2026-59717 Medium 4.3 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing 0.4%
• CVE-2026-55844 High 7.5 Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data 0.2%
• CVE-2026-54318 High 7.1 Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location 0.2%
• CVE-2026-54317 High 7.6 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN 0.3%
• CVE-2026-44698 High 8.3 Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection 0.1%
• CVE-2026-33045 High 7.3 Home Assistant has stored XSS in history-graphs 0.2%
• CVE-2026-33044 High 7.3 Home Assistant has stored XSS in Map-card through malicious device name 0.2%
• CVE-2025-62172 High 8.5 Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name 0.4%
• CVE-2025-25305 High 7.0 SSL validation for outgoing requests in Home Assistant Core and used libs not correct 0.2%
• CVE-2023-50715 Medium 4.3 User accounts disclosed to unauthenticated actors on the LAN 0.9%
• CVE-2023-41893 Medium 4.3 Account takeover via auth_callback login in Home Assistant Core 0.5%
• CVE-2023-41894 Medium 5.3 Local-only webhooks externally accessible via SniTun in Home Assistant Core 0.5%
• CVE-2023-41895 High 8.8 Cross-site Scripting via auth_callback login in Home Assistant Core 0.7%
• CVE-2023-41896 High 7.1 Fake websocket server installation permits full takeover in Home Assistant Core 0.3%
• CVE-2023-41897 High 8.8 Lack of XFO header allows clickjacking in Home Assistant Core 1.1%
• CVE-2023-41899 Medium 6.6 Partial Server-Side Request Forgery in Home Assistant Core 0.6%
• CVE-2023-41898 High 8.6 Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android 0.2%
• CVE-2023-44385 High 8.6 Client-Side Request Forgery in Home Assistant iOS/macOS native Apps 0.3%
• CVE-2023-27482 Critical 10.0 homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This im 72.2%