Esphome
6 CVEs across 2 Esphome products. Browse Esphome vulnerabilities, severities, and proof-of-concept exploits.
Esphome products with known CVEs
Esphome CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-71260 | Medium | 6.5 | 2026-08-05 | ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp… |
CVE-2026-71259 | High | 8.6 | 2026-08-05 | ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file… |
CVE-2026-23833 | High | 7.5 | 2026-01-19 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the AP… |
CVE-2025-57808 | High | 8.1 | 2025-09-02 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server aut… |
CVE-2024-29019 | High | 8.1 | 2024-04-11 | ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (co… |
CVE-2024-27287 | Medium | 6.5 | 2024-03-06 | ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configu… |
CVE-2024-27081 | High | 7.2 | 2024-02-26 | ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version… |
CVE-2021-41104 | High | 7.5 | 2021-09-28 | ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to a… |