Home-Assistant
31 CVEs across 11 Home-Assistant products. Browse Home-Assistant vulnerabilities, severities, and proof-of-concept exploits.
Home-Assistant products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66061 | High | 7.1 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or… |
CVE-2026-66060 | High | 7.1 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR… |
CVE-2026-59717 | Medium | 4.3 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an o… |
CVE-2026-64825 | Critical | 9.3 | 2026-07-21 | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on… |
CVE-2026-64824 | High | 8.4 | 2026-07-21 | Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary ab… |
CVE-2026-64823 | Medium | 4.7 | 2026-07-21 | Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attack… |
CVE-2026-55844 | High | 7.5 | 2026-06-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID all… |
CVE-2026-54318 | High | 7.1 | 2026-06-23 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceive… |
CVE-2026-54317 | High | 7.6 | 2026-06-23 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTT… |
CVE-2026-44698 | High | 8.3 | 2026-05-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home A… |
CVE-2021-47942 | High | 7.5 | 2026-05-16 | Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by… |
CVE-2026-34205 | Critical | 9.6 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host n… |
CVE-2026-33045 | Medium | 5.4 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the… |
CVE-2026-33044 | Medium | 5.4 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an… |
CVE-2025-65713 | Medium | 4.0 | 2025-12-23 | Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation… |
CVE-2025-62172 | | 2025-10-14 | Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard… | |
CVE-2025-25305 | High | 7.0 | 2025-02-18 | Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle… |
CVE-2023-50715 | Medium | 4.3 | 2023-12-15 | Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated br… |
CVE-2023-41894 | Medium | 5.3 | 2023-10-20 | Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.c… |
CVE-2023-41893 | Medium | 4.3 | 2023-10-20 | Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Co… |
CVE-2023-44385 | High | 8.6 | 2023-10-19 | The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs t… |
CVE-2023-41899 | Medium | 6.6 | 2023-10-19 | Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an… |
CVE-2023-41898 | High | 8.6 | 2023-10-19 | Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in… |
CVE-2023-41897 | High | 8.8 | 2023-10-19 | Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which spe… |
CVE-2023-41896 | High | 7.1 | 2023-10-19 | Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is… |
CVE-2023-41895 | High | 8.8 | 2023-10-19 | Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to anothe… |
CVE-2023-27482 | Critical | 10.0 | 2023-03-08 | homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Ho… |
CVE-2020-36517 | High | 7.5 | 2022-03-10 | An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal n… |
CVE-2021-3152 | Medium | 5.3 | 2021-01-26 | Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the ven… |
CVE-2018-21019 | High | 7.5 | 2019-09-23 | Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via compo… |
CVE-2017-16782 | Medium | 6.1 | 2017-11-10 | In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS. |