Skip to content
OpenAdvisories

Vendor

esphome

10 known vulnerabilities.

Products

esphome 8 device-builder 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-71260

    ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

    ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field corr…

    esphome esphome
  • Medium 6.5
    CVE-2024-27287

    ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API

    ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and H…

    esphome esphome esphome PyPI