homeassistant-ai ha-mcp

• CVE-2026-32112 Medium 6.8 ha-mcp has XSS via Unescaped HTML in OAuth Consent Form 0.2%
• CVE-2026-32111 Medium 5.3 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle 0.3%