# Home Assistant vulnerabilities Source: https://junglewise.ai/threats/vendors/home-assistant Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/home-assistant.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in Home Assistant: 0 in the last 7 days and 2 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-91130, was published on 22 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 0 critical against 1. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 13 (2 critical, 0 exploited in the wild) ## About Home Assistant An open-source home automation project focused on local control and privacy. ## Latest Home Assistant vulnerabilities - [CVE-2026-91130: Home Assistant Statistics Graph Card XSS via entity names](https://junglewise.ai/threats/cve-2026-91130-home-assistant-statistics-graph-card-xss-via-entity-names) (critical, CVSS 4, published 22 Sep 2026) - [CVE-2026-91129: Home Assistant Server-Side Request Forgery in mDNS IPP integration](https://junglewise.ai/threats/cve-2026-91129-home-assistant-server-side-request-forgery-in-mdns-ipp) (medium, CVSS 5.4, published 22 Sep 2026) - [CVE-2026-64825: Home Assistant Core path traversal in backup upload](https://junglewise.ai/threats/cve-2026-64825-home-assistant-core-path-traversal-in-backup-upload) (critical, CVSS 9.3, published 21 Jul 2026) - [CVE-2026-64824: Home Assistant Core path traversal in backup-restore function](https://junglewise.ai/threats/cve-2026-64824-home-assistant-core-path-traversal-in-backup-restore-function) (high, CVSS 8.4, published 21 Jul 2026) - [CVE-2026-64823: Home Assistant Core XSS in Shelly integration async_get_media_image](https://junglewise.ai/threats/cve-2026-64823-home-assistant-core-xss-in-shelly-integration-async-get-media) (medium, CVSS 4.7, published 21 Jul 2026) - [CVE-2026-55844: Home Assistant iOS Companion app sensitive information leak via SSID allowlist bypass](https://junglewise.ai/threats/cve-2026-55844-home-assistant-ios-companion-app-sensitive-information-leak-via) (high, CVSS 7.5, published 29 Jun 2026) - [CVE-2026-54318: Home Assistant Companion for Android location spoofing in LocationSensorManager](https://junglewise.ai/threats/cve-2026-54318-home-assistant-companion-for-android-location-spoofing-in) (high, CVSS 7.1, published 23 Jun 2026) - [CVE-2026-54317: Home Assistant Konnected integration missing authentication in KonnectedView](https://junglewise.ai/threats/cve-2026-54317-home-assistant-konnected-integration-missing-authentication-in) (high, CVSS 7.6, published 23 Jun 2026) - [CVE-2026-44698: Home Assistant Companion apps token exfiltration via WebView bridge](https://junglewise.ai/threats/cve-2026-44698-home-assistant-companion-apps-token-exfiltration-via-webview) (high, CVSS 8.3, published 29 May 2026) - [CVE-2021-47942: Home Assistant Community Store path traversal in hacsfiles endpoint](https://junglewise.ai/threats/cve-2021-47942-home-assistant-community-store-path-traversal-in-hacsfiles) (high, CVSS 7.5, published 16 May 2026) - [CVE-2026-33045: PYSEC-2026-2516 - Home Assistant has stored XSS in history-graphs](https://junglewise.ai/threats/cve-2026-33045-home-assistant-has-stored-xss-in-history-graphs) (medium, CVSS 5.4, published 27 Mar 2026) - [CVE-2026-33044: PYSEC-2026-2517 - Home Assistant has stored XSS in Map-card through malicious device name](https://junglewise.ai/threats/cve-2026-33044-home-assistant-has-stored-xss-in-map-card-through-malicious) (medium, CVSS 5.4, published 27 Mar 2026) - [CVE-2025-65713: PYSEC-2026-1454 - Home Assistant Core before is vulnerable to Directory Traversal](https://junglewise.ai/threats/cve-2025-65713-home-assistant-core-before-is-vulnerable-to-directory-traversal) (medium, CVSS 4, published 23 Dec 2025) ## Most severe Home Assistant vulnerabilities - [CVE-2026-64825: Home Assistant Core path traversal in backup upload](https://junglewise.ai/threats/cve-2026-64825-home-assistant-core-path-traversal-in-backup-upload) (critical, CVSS 9.3, published 21 Jul 2026) - [CVE-2026-91130: Home Assistant Statistics Graph Card XSS via entity names](https://junglewise.ai/threats/cve-2026-91130-home-assistant-statistics-graph-card-xss-via-entity-names) (critical, CVSS 4, published 22 Sep 2026) - [CVE-2026-64824: Home Assistant Core path traversal in backup-restore function](https://junglewise.ai/threats/cve-2026-64824-home-assistant-core-path-traversal-in-backup-restore-function) (high, CVSS 8.4, published 21 Jul 2026) - [CVE-2026-44698: Home Assistant Companion apps token exfiltration via WebView bridge](https://junglewise.ai/threats/cve-2026-44698-home-assistant-companion-apps-token-exfiltration-via-webview) (high, CVSS 8.3, published 29 May 2026) - [CVE-2026-54317: Home Assistant Konnected integration missing authentication in KonnectedView](https://junglewise.ai/threats/cve-2026-54317-home-assistant-konnected-integration-missing-authentication-in) (high, CVSS 7.6, published 23 Jun 2026) - [CVE-2026-55844: Home Assistant iOS Companion app sensitive information leak via SSID allowlist bypass](https://junglewise.ai/threats/cve-2026-55844-home-assistant-ios-companion-app-sensitive-information-leak-via) (high, CVSS 7.5, published 29 Jun 2026) - [CVE-2021-47942: Home Assistant Community Store path traversal in hacsfiles endpoint](https://junglewise.ai/threats/cve-2021-47942-home-assistant-community-store-path-traversal-in-hacsfiles) (high, CVSS 7.5, published 16 May 2026) - [CVE-2026-54318: Home Assistant Companion for Android location spoofing in LocationSensorManager](https://junglewise.ai/threats/cve-2026-54318-home-assistant-companion-for-android-location-spoofing-in) (high, CVSS 7.1, published 23 Jun 2026) - [CVE-2026-33044: PYSEC-2026-2517 - Home Assistant has stored XSS in Map-card through malicious device name](https://junglewise.ai/threats/cve-2026-33044-home-assistant-has-stored-xss-in-map-card-through-malicious) (medium, CVSS 5.4, published 27 Mar 2026) - [CVE-2026-33045: PYSEC-2026-2516 - Home Assistant has stored XSS in history-graphs](https://junglewise.ai/threats/cve-2026-33045-home-assistant-has-stored-xss-in-history-graphs) (medium, CVSS 5.4, published 27 Mar 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Home Assistant technologies - [Home Assistant Home-Assistant](https://junglewise.ai/threats/technologies/home-assistant): 5 vulnerabilities - [Home Assistant Core](https://junglewise.ai/threats/technologies/home-assistant-core): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Home Assistant vulnerabilities", https://junglewise.ai/threats/vendors/home-assistant, 9 November 2026.