homeassistant has 9 CVEs on record between 2023 and 2026. 1 was published in the last 90 days. The median CVSS is 7.0 (high), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Worst active — by depth score
CVE-2026-91130Critical· 9.3Home Assistant is open source home automation software focused on local control and privacy63CVE-2026-54317High· 7.6Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN42CVE-2025-62172HighHome Assistant is open source home automation software that puts local control and privacy first41CVE-2025-25305High· 7.0Home Assistant does not correctly validate SSL for outgoing requests in core and used libs39CVE-2025-65713MediumHome Assistant Core before is vulnerable to Directory Traversal28
homeassistant vulnerabilities
CVEs affecting homeassistant, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-91130Critical· 9.3PoCHome Assistant is open source home automation software focused on local control and privacy
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and compu…
CVE-2026-54317High· 7.6Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
CVE-2026-33044LowHome Assistant has stored XSS in Map-card through malicious device name
Home Assistant has stored XSS in Map-card through malicious device name
CVE-2026-33045LowHome Assistant has stored XSS in history-graphs
Home Assistant has stored XSS in history-graphs
CVE-2025-65713MediumHome Assistant Core before is vulnerable to Directory Traversal
Home Assistant Core before is vulnerable to Directory Traversal
CVE-2025-62172HighHome Assistant is open source home automation software that puts local control and privacy first
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject…
CVE-2025-25305High· 7.0Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
CVE-2023-50715Medium· 4.3User accounts disclosed to unauthenticated actors on the LAN
User accounts disclosed to unauthenticated actors on the LAN
CVE-2023-41893Medium· 4.3Home Assistant vulnerable to account takeover via auth_callback login
Home Assistant vulnerable to account takeover via auth_callback login