Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 15
Reset filtersHome Assistant: mDNS Server-Side Request Forgery
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates
Home Assistant has stored XSS in history-graphs
Home Assistant has stored XSS in Map-card through malicious device name
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
Home Assistant Core before is vulnerable to Directory Traversal
Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name
Home Assistant does not correctly validate SSL for outgoing requests in core and used libs
User accounts disclosed to unauthenticated actors on the LAN
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Home Assistant vulnerable to account takeover via auth_callback login
Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.