Home › Home Assistant

Home Assistant: which version is safe to update to?

Open-source home automation platform. Monthly feature releases plus patch releases. Every release below is checked against official notes, NVD CVE data and public community reports.

All recent releases

Recent CVEs (last 120 days)

• CVE-2026-64824 CRITICAL 9.3 Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive w…
• CVE-2026-91130 CRITICAL 9.3 Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatis…
• CVE-2026-64825 CRITICAL 9 Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive du…
• CVE-2026-54317 HIGH 7.6 Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnecte…
• CVE-2026-91129 MEDIUM 5.4 Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassis…
• CVE-2026-64823 LOW 2.1 Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbit…