Product by Home-Assistant
Core
23 known vulnerabilities in Core (Home-Assistant), 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-27482 | Home-Assistant Core: Improper Authentication | 10.0 | |
| Critical | CVE-2026-91130 | Home Assistant: XSS in Statistics Graph Card | — | |
| Critical | CVE-2023-41897 | Lack of XFO header allows clickjacking in Home Assistant Core | 8.8 | |
| Critical | CVE-2023-41895 | Cross-site Scripting via auth_callback login in Home Assistant Core | 8.8 | |
| High | CVE-2025-62172 | Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name | — | |
| High | CVE-2026-54317 | Home-Assistant Core: Missing Authentication for Critical Function | 7.6 | |
| High | CVE-2026-44698 | Home-Assistant Core: Code Injection | 8.3 | |
| Medium | CVE-2026-91129 | Home Assistant: mDNS Server-Side Request Forgery | 5.4 | |
| High | CVE-2026-66061 | Home-Assistant Core: Missing Authorization | 7.1 | |
| High | CVE-2026-66060 | Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers | 7.1 | |
| High | CVE-2026-55844 | Home-Assistant Core: Cleartext Transmission of Sensitive Information | 7.5 | |
| High | CVE-2026-54318 | Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location | 7.1 | |
| Medium | CVE-2023-50715 | User accounts disclosed to unauthenticated actors on the LAN | 4.3 | |
| High | CVE-2023-41899 | Partial Server-Side Request Forgery in Home Assistant Core | 6.6 | |
| High | CVE-2026-33044 | Home Assistant has stored XSS in Map-card through malicious device name | 5.4 | |
| High | CVE-2026-33045 | Home Assistant has stored XSS in history-graphs | 5.4 | |
| Medium | CVE-2026-59717 | Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing | 4.3 | |
| High | CVE-2023-44385 | Client-Side Request Forgery in Home Assistant iOS/macOS native Apps | 8.6 | |
| High | CVE-2023-41898 | Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android | 8.6 | |
| High | CVE-2025-25305 | SSL validation for outgoing requests in Home Assistant Core and used libs not correct | 7.0 | |
| Medium | CVE-2023-41894 | Local-only webhooks externally accessible via SniTun in Home Assistant Core | 5.3 | |
| Critical | CVE-2023-41896 | Fake websocket server installation permits full takeover in Home Assistant Core | 7.1 | |
| Medium | CVE-2023-41893 | Account takeover via auth_callback login in Home Assistant Core | 4.3 |