What’s Vulnerable › Products

home-assistant core vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your home-assistant core version is affected

Latest home-assistant core vulnerabilities

• CVE-2026-91130 — Home Assistant: XSS in Statistics Graph Card (CVSS 9.3)
• CVE-2026-91129 — Home Assistant: mDNS Server-Side Request Forgery (CVSS 5.4)
• CVE-2026-66061 — Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution (CVSS 7.1)
• CVE-2026-66060 — Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers (CVSS 7.1)
• CVE-2026-59717 — Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing (CVSS 4.3)
• CVE-2026-55844 — Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data (CVSS 7.5)
• CVE-2026-44698 — Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection (CVSS 8.3)
• CVE-2025-62172 — Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name (CVSS 8.5)
• CVE-2025-25305 — SSL validation for outgoing requests in Home Assistant Core and used libs not correct (CVSS 7.0)