Skip to content
OpenAdvisories

Vendor

home-assistant

28 known vulnerabilities.

Products

core 23 Home Assistant Core 3 supervisor 1 Companion app (iOS) 1 Companion app (Android) 1 Home Assistant Operating System 1 Home Assistant Supervisor 1 Home Assistant Community Store (HACS) 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-91130

    Home Assistant: XSS in Statistics Graph Card

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interp…

    home-assistant core homeassistant PyPI
  • Critical 9.3
    CVE-2026-64825

    Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

    Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Atta…

    home-assistant Home Assistant Core homeassistant PyPI
  • Critical 9.7
    CVE-2026-34205

    Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode

    Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the lo…

    home-assistant Home Assistant Operating System Home Assistant Supervisor
  • Critical 10.0
    CVE-2023-27482 Scanner template EPSS 72%

    homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for…

    home-assistant core supervisor