home-assistant core vulnerabilities

CVEs per yearBy the year they were published

1. 202310
2. 20252
3. 202611

Newest CVEs

• CVE-2026-91129

  Home Assistant: mDNS Server-Side Request Forgery

  home-assistant · core

  Medium5.4
• CVE-2026-91130

  Home Assistant: XSS in Statistics Graph Card

  home-assistant · core

  Critical9.3
• CVE-2026-66061

  Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution

  home-assistant · core

  High7.1
• CVE-2026-66060

  Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers

  home-assistant · core

  High7.1
• CVE-2026-59717

  Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

  home-assistant · core

  Medium4.3
• CVE-2026-55844

  Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

  home-assistant · core

  High7.5
• CVE-2026-54318

  Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location

  home-assistant · core

  High7.1
• CVE-2026-54317

  Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

  home-assistant · core

  High7.6
• CVE-2026-44698

  Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

  home-assistant · core

  High8.3
• CVE-2026-33045

  Home Assistant has stored XSS in history-graphs

  home-assistant · core

  High7.3