What’s Vulnerable › Products

Home-Assistant vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your Home-Assistant version is affected

Latest Home-Assistant vulnerabilities

• CVE-2026-54317 — Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN (CVSS 7.6)
• CVE-2026-33045 — Home Assistant has stored XSS in history-graphs (CVSS 5.4)
• CVE-2026-33044 — Home Assistant has stored XSS in Map-card through malicious device name (CVSS 5.4)
• CVE-2025-65713 — (CVSS 4.0)
• CVE-2023-50715 — User accounts disclosed to unauthenticated actors on the LAN (CVSS 4.3)
• CVE-2023-41894 — Local-only webhooks externally accessible via SniTun in Home Assistant Core (CVSS 5.3)
• CVE-2023-41893 — Account takeover via auth_callback login in Home Assistant Core (CVSS 5.4)
• CVE-2023-41899 — Partial Server-Side Request Forgery in Home Assistant Core (CVSS 7.2)
• CVE-2023-41897 — Lack of XFO header allows clickjacking in Home Assistant Core (CVSS 9.6)
• CVE-2023-41896 — Fake websocket server installation permits full takeover in Home Assistant Core (CVSS 9.0)
• CVE-2023-41895 — Cross-site Scripting via auth_callback login in Home Assistant Core (CVSS 9.6)
• CVE-2023-27482 — (CVSS 10.0)
• CVE-2020-36517 — (CVSS 7.5)
• CVE-2021-3152 — (CVSS 5.3)
• CVE-2018-21019 — (CVSS 7.5)
• CVE-2017-16782 — (CVSS 6.1)