Vendor

    Home-Assistant

    33 known vulnerabilities in products by Home-Assistant, 0 of them actively exploited (CISA KEV).

    Key figures

    33

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Home-Assistant
    CriticalCVE-2023-27482

    Home-Assistant Core: Improper Authentication

    		10.0
    HighCVE-2020-36517

    Home Assistant: Information Disclosure

    		7.5
    CriticalCVE-2026-64824

    Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

    		8.4
    CriticalCVE-2026-91130

    Home Assistant: XSS in Statistics Graph Card

    		—
    CriticalCVE-2026-64825

    Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

    		9.3
    HighCVE-2018-21019

    Home Assistant: Information Disclosure

    		7.5
    CriticalCVE-2023-41897

    Lack of XFO header allows clickjacking in Home Assistant Core

    		8.8
    MediumCVE-2021-3152

    Home Assistant: security vulnerability

    		5.3
    HighCVE-2021-47942

    Home Assistant Community Store 1.10.0 Path Traversal Account Takeover

    		7.5
    CriticalCVE-2023-41895

    Cross-site Scripting via auth_callback login in Home Assistant Core

    		8.8
    CriticalCVE-2026-34205

    Home Assistant Supervisor: Improper Restriction of Communication Channel to Intended Endpoints

    		9.6
    HighCVE-2025-62172

    Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name

    		—
    HighCVE-2026-54317

    Home-Assistant Core: Missing Authentication for Critical Function

    		7.6
    HighCVE-2026-44698

    Home-Assistant Core: Code Injection

    		8.3
    MediumCVE-2026-91129

    Home Assistant: mDNS Server-Side Request Forgery

    		5.4
    HighCVE-2026-66060

    Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers

    		7.1
    HighCVE-2026-66061

    Home-Assistant Core: Missing Authorization

    		7.1
    HighCVE-2026-55844

    Home-Assistant Core: Cleartext Transmission of Sensitive Information

    		7.5
    MediumCVE-2017-16782

    Home Assistant: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2026-54318

    Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location

    		7.1
    MediumCVE-2023-50715

    User accounts disclosed to unauthenticated actors on the LAN

    		4.3
    HighCVE-2023-41899

    Partial Server-Side Request Forgery in Home Assistant Core

    		6.6
    HighCVE-2026-33044

    Home Assistant has stored XSS in Map-card through malicious device name

    		5.4
    HighCVE-2026-33045

    Home Assistant has stored XSS in history-graphs

    		5.4
    MediumCVE-2026-59717

    Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

    		4.3

    All vulnerabilities in search

    Products

    Products by Home-Assistant
    Core230
    Home Assistant160
    Home Assistant Companion30
    Home Assistant Core30