Cpe:2.3:a:home-Assistant:home_assistant:*:*:*:*:*:*:*:*

Home Assistant contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-91130) in the Statistics Graph card, allowing arbitrary JavaScript execution when viewing entities with malicious names.