Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how home assistant compares to other vendors in security performance

View Risk Score →

Home Assistant Home Assistant CoreHome Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Risk 61
Severity
9
First published (updated )
CVE-2026-64825

Home Assistant Home Assistant CoreHome Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Risk 72
Severity
9.3
First published (updated )
CVE-2026-64824

Home Assistant Home Assistant CoreHome Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

Risk 31
Severity
2.1
First published (updated )
CVE-2026-64823

Home Assistant iOS Companion AppHome Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

Risk 43
Severity
7.5
First published (updated )
CVE-2026-55844

Home Assistant Home AssistantHome Assistant: Exported BroadcastReceiver allows local apps to spoof device location

Risk 40
Severity
7.1
First published (updated )
CVE-2026-54318
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Home Assistant Home Assistant Companion iOSHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

Risk 71
Severity
8.3
First published (updated )
CVE-2026-44698

Home Assistant Home Assistant Community Store (HACS)Home Assistant Community Store 1.10.0 Path Traversal Account Takeover

Risk 47
Severity
8.7
First published (updated )
CVE-2021-47942

Home Assistant Home Assistant SupervisorHome Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode

Risk 59
Severity
9.7
EPSS
0.02%
First published (updated )
CVE-2026-34205

Home Assistant Home AssistantHome Assistant has stored XSS in history-graphs

Risk 69
Severity
7.3
First published (updated )
CVE-2026-33045

Home Assistant Home AssistantHome Assistant has stored XSS in Map-card through malicious device name

Risk 69
Severity
7.3
First published (updated )
CVE-2026-33044
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Home Assistant ha-mcpha-mcp has XSS via Unescaped HTML in OAuth Consent Form

Risk 38
Severity
6.8
EPSS
0.03%
First published (updated )
CVE-2026-32112

Home Assistant MCP Serverha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

Risk 19
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2026-32111

BleepingComputerHackers exploit 34 zero-days on first day of Pwn2Own Ireland

Exploited
Zeroday
First published (updated )
News
BleepingComputer

Home Assistant Home AssistantHome Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name

Risk 78
Severity
8.5
First published (updated )
CVE-2025-62172

Home Assistant homeassistant-tapo-controlCode injection in a GitHub Actions workflow of homeassistant-tapo-control - CVE-2025-55192

Risk 56
First published (updated )
Advisory
GHSL-2025-101
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Home Assistant homeassistant-tapo-controlGHSL-2025-101: Code injection in a GitHub Actions workflow of homeassistant-tapo-control - CVE-2025-55192

Risk 62
Severity
8.6
First published (updated )
CVE-2025-55192

Home Assistant CoreSSL validation for outgoing requests in Home Assistant Core and used libs not correct

Risk 40
Severity
7
EPSS
0.03%
First published (updated )
CVE-2025-25305

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203