Read the docs

home-assistant

Records33All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

home-assistant records in CISA KEV

No home-assistant vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Home-assistant 16 records CRITICAL Home Assistant Companion 3 records MEDIUM Home-assistant-js-websocket 1 record MEDIUM Supervisor 1 record CRITICAL

Records

33 records

TI-2021-22555 CVE-2021-47942 · GHSA-cqg8-v99m-gv9m

Home Assistant Community Store 1.10.0 Path Traversal Account Takeover

Priority HIGH 77

Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00498 Published 2026-05-16 Fixed in 1.10.0 CWE-22
TI-2026-61899 CVE-2026-91130 · GHSA-wx4m-69m9-gx3m

Home Assistant: XSS in Statistics Graph Card

Priority HIGH 75

Home Assistant is open source home automation software focused on local control and privacy.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.00483 Published 2026-09-22 Fixed in 2026.7.0 CWE-80
TI-2026-46349 CVE-2026-64824 · GHSA-cwh8-w64c-4j5h

Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Priority HIGH 75

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive wi…

CVSS 4.0CRITICAL 9.3 Network High privileges User interaction EPSS 0.00713 Published 2026-07-21 Fixed in 2026.7.0 CWE-22
TI-2026-25491 CVE-2026-33045 · GHSA-46j8-vpx8-6p72

Home Assistant has stored XSS in history-graphs

Priority HIGH 67

Home Assistant is open source home automation software that puts local control and privacy first.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00209 Published 2026-03-27 Fixed in 2026.01 CWE-79
TI-2026-61898 CVE-2026-91129 · GHSA-4ghv-53cq-7wp3

Home Assistant: mDNS Server-Side Request Forgery

Priority MEDIUM 58

Home Assistant is open source home automation software focused on local control and privacy.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00294 Published 2026-09-22 Fixed in 2026.2.3 CWE-918
TI-2026-46350 CVE-2026-64825 · GHSA-5hxg-r395-fqxx

Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Priority MEDIUM 46

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive dur…

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.0058 Published 2026-07-21 Fixed in 2026.6.0 CWE-22
TI-2020-18752 CVE-2020-36517 · GHSA-wj7x-544h-j3j3

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant…

Priority LOW 38

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02897 Published 2022-03-07 No fix listed CWE-203
Load more
Open these records in search →