home-assistant

Records33All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

home-assistant records in CISA KEV

No home-assistant vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Home-assistant 16 records CRITICAL Home Assistant Companion 3 records MEDIUM Home-assistant-js-websocket 1 record MEDIUM Supervisor 1 record CRITICAL

Records

16 records in Home-assistant · all components

TI-2023-12210 CVE-2023-27482

Improper authentication in home-assistant core

CRITICAL 87

homeassistant is an open source home automation tool.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.72167 Published 2023-03-08 Fixed in 2023.3.2, 2023.03.3 CWE-287

TI-2026-25491 CVE-2026-33045 · GHSA-46j8-vpx8-6p72

Home Assistant has stored XSS in history-graphs

HIGH 67

Home Assistant is open source home automation software that puts local control and privacy first.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00209 Published 2026-03-27 Fixed in 2026.01 CWE-79

TI-2026-25490 CVE-2026-33044 · GHSA-r584-6283-p7xc

Home Assistant has stored XSS in Map-card through malicious device name

HIGH 67

Home Assistant is open source home automation software that puts local control and privacy first.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00231 Published 2026-03-27 Fixed in 2026.01 CWE-79

TI-2026-39212 CVE-2026-54317 · GHSA-x84v-g949-293w

Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN

HIGH 66

Home Assistant is open source home automation software that puts local control and privacy first.

CVSS 3.1HIGH 7.6 Adjacent network No auth No interaction EPSS 0.00308 Published 2026-06-23 Fixed in 2026.6.0 CWE-200

TI-2025-40423 CVE-2025-65713 · GHSA-pp3g-xmm4-5cw9

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal.

MEDIUM 52

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00405 Published 2025-12-23 Fixed in 2025.8.0 CWE-22

TI-2023-22289 CVE-2023-41897

Lack of XFO header allows clickjacking in Home Assistant Core

MEDIUM 45

Home assistant is an open source home automation.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01079 Published 2023-10-19 Fixed in 2023.9.0 CWE-1021

TI-2023-22287 CVE-2023-41895

Cross-site Scripting via auth_callback login in Home Assistant Core

MEDIUM 44

Home assistant is an open source home automation.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00712 Published 2023-10-19 Fixed in 2023.9.0 CWE-79

TI-2023-22288 CVE-2023-41896

Fake websocket server installation permits full takeover in Home Assistant Core

MEDIUM 41

Home assistant is an open source home automation.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00315 Published 2023-10-19 No fix listed CWE-345

TI-2020-18752 CVE-2020-36517 · GHSA-wj7x-544h-j3j3

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant…

LOW 38

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02897 Published 2022-03-07 No fix listed CWE-203

TI-2018-14981 CVE-2018-21019 · GHSA-mh78-8f49-vjg3

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an…

LOW 36

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01739 Published 2019-09-23 Fixed in 0.67.0 CWE-200

TI-2023-22291 CVE-2023-41899

Partial Server-Side Request Forgery in Home Assistant Core

LOW 34

Home assistant is an open source home automation.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0056 Published 2023-10-19 Fixed in 2023.9.0 CWE-918

TI-2017-12341 CVE-2017-16782

In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent…

LOW 29

In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00772 Published 2017-11-10 No fix listed CWE-79

TI-2021-02238 CVE-2021-3152 · GHSA-jxm2-grrm-xcrf

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent…

LOW 28

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02159 Published 2021-01-21 No fix listed CWE-22

TI-2023-22286 CVE-2023-41894

Local-only webhooks externally accessible via SniTun in Home Assistant Core

LOW 25

Home assistant is an open source home automation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00505 Published 2023-10-19 Fixed in 2023.9.0 CWE-669

TI-2023-22285 CVE-2023-41893 · GHSA-qhhj-7hrc-gqj5

Account takeover via auth_callback login in Home Assistant Core

LOW 25

Home assistant is an open source home automation.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00452 Published 2023-10-19 Fixed in 2023.9.0 CWE-200

TI-2023-27661 CVE-2023-50715 · GHSA-jqpc-rc7g-vf83

User accounts disclosed to unauthenticated actors on the LAN

LOW 22

Home Assistant is open source home automation software.

CVSS 3.1MEDIUM 4.3 Adjacent network No auth No interaction EPSS 0.00908 Published 2023-12-15 Fixed in 2023.12.3 CWE-200

Open these records in search →