homeassistant vulnerabilities

CVEs whose affected-version data names the homeassistant package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

9 CVEsRSS

CVE-2026-91130Critical· 9.3PoC

1mo ago

Home Assistant is open source home automation software focused on local control and privacy

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and compu…

▾ Abyssalhomeassistant · homeassistantEPSS 0.48%via NVD

CVE-2026-54317High· 7.6

4mo ago

Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

▾ Twilighthomeassistant · homeassistantEPSS 0.31%via GHSA

CVE-2026-33044Low

7mo ago

Home Assistant is open source home automation software that puts local control and privacy first

Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject…

▾ Twilighthomeassistant · homeassistantEPSS 0.42%via NVD

CVE-2025-25305High· 7.0

1y ago

Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

▾ Twilighthomeassistant · homeassistantEPSS 0.25%via OSV

CVE-2023-50715Medium· 4.3

2y ago

User accounts disclosed to unauthenticated actors on the LAN

▾ Sunlithomeassistant · homeassistantEPSS 0.91%via OSV

CVE-2023-41893Medium· 4.3

3y ago

Home Assistant vulnerable to account takeover via auth_callback login

▾ Sunlithomeassistant · homeassistantEPSS 0.45%via OSV