https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 24 Sep 2026 20:03:54 +0000 https://vulnerability.circl.lu/sighting/1b3d288b-7e78-4015-80bc-71e01b26ed54/export {"uuid": "1b3d288b-7e78-4015-80bc-71e01b26ed54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-91130", "type": "published-proof-of-concept", "source": "https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m", "content": "", "creation_timestamp": "2026-09-22T22:35:02.557617Z"} {"uuid": "1b3d288b-7e78-4015-80bc-71e01b26ed54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-91130", "type": "published-proof-of-concept", "source": "https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m", "content": "", "creation_timestamp": "2026-09-22T22:35:02.557617Z"} https://vulnerability.circl.lu/sighting/1b3d288b-7e78-4015-80bc-71e01b26ed54/export Tue, 22 Sep 2026 22:35:02 +0000 https://vulnerability.circl.lu/sighting/e5d0c17a-2e97-44ae-aa31-ed0c42edeaf6/export {"uuid": "e5d0c17a-2e97-44ae-aa31-ed0c42edeaf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://gist.github.com/alon710/4c2c1021543d93cf5f79daddff3b5a00", "content": "# CVE-2026-91130: CVE-2026-91130: DOM-Based Cross-Site Scripting in Home Assistant Statistics Graph Card\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91130\n\n## Summary\nCVE-2026-91130 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Home Assistant open-source home automation platform. Prior to version 2026.7.0, the Statistics Graph card rendered series tooltips using raw HTML string interpolation without escaping user-controlled entity friendly names. By abusing this vulnerability, an authenticated user with low-privilege access can inject arbitrary HTML and JavaScript into entity name fields, which executes in the context of an administrative user's browser session upon hovering over a data point on an affected chart.\n\n## TL;DR\nUnescaped entity friendly names in Home Assistant Statistics Graph tooltips allow DOM-based XSS, leading to potential administrative session hijacking.\n\n## Technical Details\n\n- **CWE ID**: CWE-80\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Required Privilege**: Low (PR:L)\n- **User Interaction**: Active (UI:A)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Home Assistant Core\n- Home Assistant Frontend\n- **Home Assistant Core**: < 2026.7.0 (Fixed in: `2026.7.0`)\n\n## Mitigation\n\n- Upgrade Home Assistant Core to version 2026.7.0 or newer\n- Restrict configuration and dashboard editing access to trusted administrators\n- Sanitize or audit third-party integration entity registrations\n\n**Remediation Steps:**\n1. Check current software version in the Home Assistant settings panel.\n2. Download and apply the Core update to version 2026.7.0.\n3. Audit the SQLite or PostgreSQL database for persistent states containing script tags.\n\n## References\n\n- [GitHub Security Advisory GHSA-wx4m-69m9-gx3m](https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m)\n- [GitHub Pull Request #52235](https://github.com/home-assistant/frontend/pull/52235)\n- [Fix Commit b8c201b](https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614)\n- [Home Assistant 2026.7.0 Release Notes](https://github.com/home-assistant/core/releases/tag/2026.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91130) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T21:32:14.674980Z"} {"uuid": "e5d0c17a-2e97-44ae-aa31-ed0c42edeaf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://gist.github.com/alon710/4c2c1021543d93cf5f79daddff3b5a00", "content": "# CVE-2026-91130: CVE-2026-91130: DOM-Based Cross-Site Scripting in Home Assistant Statistics Graph Card\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91130\n\n## Summary\nCVE-2026-91130 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Home Assistant open-source home automation platform. Prior to version 2026.7.0, the Statistics Graph card rendered series tooltips using raw HTML string interpolation without escaping user-controlled entity friendly names. By abusing this vulnerability, an authenticated user with low-privilege access can inject arbitrary HTML and JavaScript into entity name fields, which executes in the context of an administrative user's browser session upon hovering over a data point on an affected chart.\n\n## TL;DR\nUnescaped entity friendly names in Home Assistant Statistics Graph tooltips allow DOM-based XSS, leading to potential administrative session hijacking.\n\n## Technical Details\n\n- **CWE ID**: CWE-80\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Required Privilege**: Low (PR:L)\n- **User Interaction**: Active (UI:A)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Home Assistant Core\n- Home Assistant Frontend\n- **Home Assistant Core**: < 2026.7.0 (Fixed in: `2026.7.0`)\n\n## Mitigation\n\n- Upgrade Home Assistant Core to version 2026.7.0 or newer\n- Restrict configuration and dashboard editing access to trusted administrators\n- Sanitize or audit third-party integration entity registrations\n\n**Remediation Steps:**\n1. Check current software version in the Home Assistant settings panel.\n2. Download and apply the Core update to version 2026.7.0.\n3. Audit the SQLite or PostgreSQL database for persistent states containing script tags.\n\n## References\n\n- [GitHub Security Advisory GHSA-wx4m-69m9-gx3m](https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m)\n- [GitHub Pull Request #52235](https://github.com/home-assistant/frontend/pull/52235)\n- [Fix Commit b8c201b](https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614)\n- [Home Assistant 2026.7.0 Release Notes](https://github.com/home-assistant/core/releases/tag/2026.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91130) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T21:32:14.674980Z"} https://vulnerability.circl.lu/sighting/e5d0c17a-2e97-44ae-aa31-ed0c42edeaf6/export Tue, 22 Sep 2026 21:32:14 +0000 https://vulnerability.circl.lu/sighting/7245b543-8172-4e96-8064-6b00374ff08e/export {"uuid": "7245b543-8172-4e96-8064-6b00374ff08e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mw5542k2ng2q", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-91130: Home Assistant is open source home automation software focused on local control and privacy\nCVSS 9.3\nhttps://beta.vulnsea.com/cve/CVE-2026-91130\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-22T21:08:18.734273Z"} {"uuid": "7245b543-8172-4e96-8064-6b00374ff08e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mw5542k2ng2q", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-91130: Home Assistant is open source home automation software focused on local control and privacy\nCVSS 9.3\nhttps://beta.vulnsea.com/cve/CVE-2026-91130\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-22T21:08:18.734273Z"} https://vulnerability.circl.lu/sighting/7245b543-8172-4e96-8064-6b00374ff08e/export Tue, 22 Sep 2026 21:08:18 +0000 https://vulnerability.circl.lu/sighting/9c58c613-c3db-4833-8d4a-7ffc1bf2ce09/export {"uuid": "9c58c613-c3db-4833-8d4a-7ffc1bf2ce09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw53jnknol2f", "content": "CVE-2026-91130 - core\nThe Statistics Graph card in Home Assistant core could run unwanted code when a user hovers over a data point, if an entity name contains specially crafted text. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#core #homeassistant #CVE #infosec", "creation_timestamp": "2026-09-22T20:40:07.561578Z"} {"uuid": "9c58c613-c3db-4833-8d4a-7ffc1bf2ce09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw53jnknol2f", "content": "CVE-2026-91130 - core\nThe Statistics Graph card in Home Assistant core could run unwanted code when a user hovers over a data point, if an entity name contains specially crafted text. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#core #homeassistant #CVE #infosec", "creation_timestamp": "2026-09-22T20:40:07.561578Z"} https://vulnerability.circl.lu/sighting/9c58c613-c3db-4833-8d4a-7ffc1bf2ce09/export Tue, 22 Sep 2026 20:40:07 +0000 https://vulnerability.circl.lu/sighting/4c364024-8b60-48a5-96f5-5cf18c14f0f4/export {"uuid": "4c364024-8b60-48a5-96f5-5cf18c14f0f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aq36anmwp35zg", "content": "CVE-2026-91130 - Home Assistant: XSS in Statistics Graph Card\nCVE ID : CVE-2026-91130\n \n Published : Sept. 22, 2026, 7:02 p.m. | 26\u00a0minutes ago\n \n Description : Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the ...", "creation_timestamp": "2026-09-22T20:20:52.053841Z"} {"uuid": "4c364024-8b60-48a5-96f5-5cf18c14f0f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aq36anmwp35zg", "content": "CVE-2026-91130 - Home Assistant: XSS in Statistics Graph Card\nCVE ID : CVE-2026-91130\n \n Published : Sept. 22, 2026, 7:02 p.m. | 26\u00a0minutes ago\n \n Description : Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the ...", "creation_timestamp": "2026-09-22T20:20:52.053841Z"} https://vulnerability.circl.lu/sighting/4c364024-8b60-48a5-96f5-5cf18c14f0f4/export Tue, 22 Sep 2026 20:20:52 +0000 https://vulnerability.circl.lu/sighting/745d022b-224f-48b5-a553-814941c8344c/export {"uuid": "745d022b-224f-48b5-a553-814941c8344c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw522mbf2f2j", "content": "\ud83d\udea8 CVE-2026-91130 \u2014 CVSS 9.3 CRITICAL\n\nHome Assistant is open source home automation software focused on local control and privacy. Prior to 2026....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-91130\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T20:13:49.099707Z"} {"uuid": "745d022b-224f-48b5-a553-814941c8344c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw522mbf2f2j", "content": "\ud83d\udea8 CVE-2026-91130 \u2014 CVSS 9.3 CRITICAL\n\nHome Assistant is open source home automation software focused on local control and privacy. Prior to 2026....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-91130\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T20:13:49.099707Z"} https://vulnerability.circl.lu/sighting/745d022b-224f-48b5-a553-814941c8344c/export Tue, 22 Sep 2026 20:13:49 +0000