ES
Vendor
esphome
11
CVEs
0
On KEV
1
New 30D
Products
DE9.8
device-builder
esphome
2 CVEs0 on KEV1 new
ES8.8
esphome
esphome
7 CVEs0 on KEV0 new
EF8.1
Esphome Firmware
Esphome
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59177 New | DE device-builder esphome | 8.8 | Oct 28 | ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces |
| CVE-2026-59178 | DE device-builder esphome | 9.8 | Sep 14 | ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade |
| CVE-2026-71260 | ES esphome esphome | 6.5 | Aug 5 | ESPHome web_server Plaintext Password Disclosure via JSON "value" Field |
| CVE-2026-71259 | ES esphome esphome | 8.6 | Aug 5 | ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution |
| CVE-2026-23833 | ES esphome esphome | 7.5 | Jan 19 | ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component |
| CVE-2025-57808 | ES esphome esphome | 8.1 | Sep 2 | ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header |
| CVE-2024-29019 | ES esphome esphome | 8.1 | Mar 21 | ESPHome vulnerable to Authentication bypass via Cross site request forgery |
| CVE-2024-27287 | ES esphome esphome | 8.7 | Mar 6 | ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API |
| CVE-2024-27081 | ES esphome esphome | 8.8 | Feb 26 | ESPHome remote code execution via arbitrary file write |
| CVE-2021-41104 | EF Esphome Firmware Esphome | 7.5 | Sep 28 | ESPHome is a system to control the ESP8266/ESP32 |