LOWPyPI
GHSA-46j8-vpx8-6p72· CVE-2026-33045, PYSEC-2026-2516Home Assistant has stored XSS in history-graphs
Modified: 7/13/2026
package
PyPI/homeassistant
pkg:pypi/homeassistant
MEDIUM5.4PyPI
GHSA-4ghv-53cq-7wp3· CVE-2026-91129Home Assistant: mDNS Server-Side Request Forgery
Modified: 9/22/2026
CRITICAL9.3PyPI
GHSA-5hxg-r395-fqxx· CVE-2026-64825, PYSEC-2026-3669Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
Modified: 8/19/2026
MEDIUM4.3PyPI
GHSA-jqpc-rc7g-vf83· CVE-2023-50715, PYSEC-2026-1451User accounts disclosed to unauthenticated actors on the LAN
Modified: 7/7/2026
HIGH7.0PyPI
GHSA-m3pm-rpgg-5wj6· CVE-2025-25305, PYSEC-2026-1452Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-mh78-8f49-vjg3· CVE-2018-21019, PYSEC-2019-221Home Assistant information disclosure vulnerability
Modified: 9/20/2024
HIGHPyPI
GHSA-mq77-rv97-285m· CVE-2025-62172, PYSEC-2026-1453Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name
Modified: 7/8/2026
MEDIUMPyPI
GHSA-pp3g-xmm4-5cw9· CVE-2025-65713, PYSEC-2026-1454Home Assistant Core before is vulnerable to Directory Traversal
Modified: 7/7/2026
MEDIUM4.3PyPI
GHSA-qhhj-7hrc-gqj5· CVE-2023-41893, PYSEC-2023-214Home Assistant vulnerable to account takeover via auth_callback login
Modified: 9/10/2026
LOWPyPI
GHSA-r584-6283-p7xc· CVE-2026-33044, PYSEC-2026-2517Home Assistant has stored XSS in Map-card through malicious device name
Modified: 7/13/2026
CRITICALPyPI
GHSA-wx4m-69m9-gx3m· CVE-2026-91130Home Assistant: XSS in Statistics Graph Card
Modified: 9/22/2026
HIGH7.6PyPI
GHSA-x84v-g949-293w· CVE-2026-54317, PYSEC-2026-241Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Modified: 7/20/2026
—PyPI
PYSEC-2019-221· CVE-2018-21019, GHSA-mh78-8f49-vjg3Modified: 6/10/2026
MEDIUM5.4PyPI
PYSEC-2023-214· CVE-2023-41893, GHSA-qhhj-7hrc-gqj5Modified: 11/8/2023
MEDIUM4.3PyPI
PYSEC-2026-1451· CVE-2023-50715, GHSA-jqpc-rc7g-vf83User accounts disclosed to unauthenticated actors on the LAN
Modified: 7/7/2026
HIGH7.0PyPI
PYSEC-2026-1452· CVE-2025-25305, GHSA-m3pm-rpgg-5wj6Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
Modified: 7/7/2026
—PyPI
PYSEC-2026-1453· CVE-2025-62172, GHSA-mq77-rv97-285mHome Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name
Modified: 7/7/2026
—PyPI
PYSEC-2026-1454· CVE-2025-65713, GHSA-pp3g-xmm4-5cw9Home Assistant Core before is vulnerable to Directory Traversal
Modified: 7/7/2026
HIGH7.6PyPI
PYSEC-2026-241· CVE-2026-54317, GHSA-x84v-g949-293wModified: 6/27/2026
—PyPI
PYSEC-2026-2516· CVE-2026-33045, GHSA-46j8-vpx8-6p72Home Assistant has stored XSS in history-graphs
Modified: 7/13/2026
—PyPI
PYSEC-2026-2517· CVE-2026-33044, GHSA-r584-6283-p7xcHome Assistant has stored XSS in Map-card through malicious device name
Modified: 7/13/2026
CRITICAL9.3PyPI
PYSEC-2026-3669· CVE-2026-64825, GHSA-5hxg-r395-fqxxHome Assistant Core vulnerable to Path Traversal via backup upload during onboarding
Modified: 8/19/2026