homeassistant-ai
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| ha-mcp | 2 | – | Mar 11, 2026 |
Exploited and recent CVEs
- CVE-2026-32112 ha-mcp has XSS via Unescaped HTML in OAuth Consent Form 0.2%
- CVE-2026-32111 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle 0.3%