Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

33 records

Vendor: home-assistant Clear all filters
TI-2026-61898 CVE-2026-91129 · GHSA-4ghv-53cq-7wp3

Home Assistant: mDNS Server-Side Request Forgery

Priority MEDIUM 58

Home Assistant is open source home automation software focused on local control and privacy.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00294 Published 2026-09-22 Fixed in 2026.2.3 CWE-918
TI-2026-61899 CVE-2026-91130 · GHSA-wx4m-69m9-gx3m

Home Assistant: XSS in Statistics Graph Card

Priority HIGH 75

Home Assistant is open source home automation software focused on local control and privacy.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.00483 Published 2026-09-22 Fixed in 2026.7.0 CWE-80
TI-2026-46350 CVE-2026-64825 · GHSA-5hxg-r395-fqxx

Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Priority MEDIUM 46

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive dur…

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.0058 Published 2026-07-21 Fixed in 2026.6.0 CWE-22
TI-2026-46349 CVE-2026-64824 · GHSA-cwh8-w64c-4j5h

Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Priority HIGH 75

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive wi…

CVSS 4.0CRITICAL 9.3 Network High privileges User interaction EPSS 0.00713 Published 2026-07-21 Fixed in 2026.7.0 CWE-22
TI-2026-46348 CVE-2026-64823 · GHSA-r3v5-j696-5grq

Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

Priority LOW 11

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitr…

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00296 Published 2026-07-21 Fixed in 2026.5.4 CWE-79
TI-2021-22555 CVE-2021-47942 · GHSA-cqg8-v99m-gv9m

Home Assistant Community Store 1.10.0 Path Traversal Account Takeover

Priority HIGH 77

Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00498 Published 2026-05-16 Fixed in 1.10.0 CWE-22
TI-2026-25491 CVE-2026-33045 · GHSA-46j8-vpx8-6p72

Home Assistant has stored XSS in history-graphs

Priority HIGH 67

Home Assistant is open source home automation software that puts local control and privacy first.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00209 Published 2026-03-27 Fixed in 2026.01 CWE-79
Load more