home-assistant vulnerabilities

CVEs per yearBy the year they were published

1. 202310
2. 20252
3. 202615
4. 20261

Newest CVEs

• CVE-2026-91129

  Home Assistant: mDNS Server-Side Request Forgery

  home-assistant · core

  Medium5.4
• CVE-2026-91130

  Home Assistant: XSS in Statistics Graph Card

  home-assistant · core

  Critical9.3
• CVE-2026-66061

  Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution

  home-assistant · core

  High7.1
• CVE-2026-66060

  Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers

  home-assistant · core

  High7.1
• CVE-2026-59717

  Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

  home-assistant · core

  Medium4.3
• CVE-2026-64825

  Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

  home-assistant · Home Assistant Core

  Critical9.0
• CVE-2026-64824

  Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

  home-assistant · Home Assistant Core

  Critical9.3
• CVE-2026-64823

  Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

  home-assistant · Home Assistant Core

  Low2.1
• CVE-2026-55844

  Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

  home-assistant · core

  High7.5
• CVE-2026-54318

  Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location

  home-assistant · core

  High7.1