device-builder vulnerabilities

2 known vulnerabilities in device-builder from Esphome. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  device-builder: Binding to an Unrestricted IP Address

  CVE-2026-59177Oct 28, 2026EsphomeEPSS 1.17%

  ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is e

• 9.8 Critical severity

  device-builder: Missing Authentication for Critical Functionality

  CVE-2026-59178Sep 14, 2026Esphome

  ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` d