Dieser Blog-Eintrag vom 19.10.2023 ist mir ganz entgangen 
https://www.home-assistant.io/blog/2023 ... assistant/ und wurde hier im Forum glaube ich auch noch nicht erwähnt.
Wie man dort lesen kann wurden bei externen Tests einige Sicherheitslücken bei HA gefunden, welche dann mit der HA Core 2023.9 gefixt wurden. Welche Lücken das waren kann man dann hier noch einmal aufgelistet sehen/lesen: https://www.home-assistant.io/security
Hier die Auflistung von dort:
2023-10-19: Actions expression injection in helpers/version/action.yml
Severity: Low (This is an internal project)
Detailed information: Security advisory
Discovered by: Jorge Rosillo, Peter Stöckli (GitHub Security Lab)
Fixed in: Home Assistant GitHub Actions released on September 5, 2023
2023-10-19: Arbitrary URL load in Android WebView in MyActivity.kt
Severity: High (CVSS: 8.6)
Detailed information: Security advisory
Assigned CVE: CVE-2023-41898
Discovered by: Tony Torralba (GitHub Security Lab)
Fixed in: Home Assistant for Android 2023.9.2
2023-10-19: Partial Server-Side Request Forgery in Core
Severity: Low
Detailed information: Security advisory
Assigned CVE: CVE-2023-41899
Discovered by: Alvaro Muñoz (GitHub Security Lab)
Fixed in: Home Assistant Core 2023.9
2023-10-19: Client-Side Request Forgery in iOS/macOS native Apps
Severity: High (CVSS: 8.6)
Detailed information: Security advisory
Assigned CVE: CVE-2023-44385
Discovered by: Alvaro Muñoz (GitHub Security Lab)
Fixed in: Home Assistant for iOS 2023.7
2023-10-19: Account takeover via auth_callback login
Severity: Low
Detailed information: Security advisory
Assigned CVE: CVE-2023-41893
Discovered by: Cure53 (Funded by Nabu Casa)
Fixed in: Home Assistant Core 2023.9
2023-10-19: Full takeover via javascript URI in auth_callback login
Severity: Critical
Detailed information: Security advisory
Assigned CVE: CVE-2023-41895
Discovered by: Cure53 (Funded by Nabu Casa)
Fixed in: Home Assistant Core 2023.9
2023-10-19: Local-only webhooks externally accessible via SniTun
Severity: Low
Detailed information: Security advisory
Assigned CVE: CVE-2023-41894
Discovered by: Cure53 (Funded by Nabu Casa)
Fixed in: Home Assistant Core 2023.9
2023-10-19: Fake WS server installation permits full takeover
Severity: Critical
Detailed information: Security advisory
Assigned CVE: CVE-2023-41896
Discovered by: Cure53 (Funded by Nabu Casa)
Fixed in: Home Assistant Core 2023.9 & home-assistant-js-websocket 8.2.0 (npm)
2023-10-19: Lack of XFO header allows clickjacking
Severity: Critical
Detailed information: _Security advisory
Assigned CVE: CVE-2023-41897
Discovered by: Cure53 (Funded by Nabu Casa)
Fixed in: Home Assistant Core 2023.9
Für die User die das ggf. noch nicht gemacht haben wäre also wohl ein Update auf Core 2023.9.x und bei den entsprechenden HA Apps angesagt/empfehlenswert. 
VG Jim