ZE
Product
zephyr
69
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 13High 29Medium 27Low 0
Watch
Add zephyr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-0849 | 6.8 | Mar 14 | crypto: ATAES132A response length allows stack buffer overflow Affected: before 4.4.0 |
| CVE-2023-4265 | 6.8 | Aug 12 | Buffer overflow in Zephyr USB Affected: through 3.3 |
| CVE-2026-5072 | 6.5 | May 22 | ptp: Potential Denial of Service via PTP Interval Shift Affected: before 4.3.1 |
| CVE-2025-12899 | 6.5 | Jan 30 | net: icmp: Out of bound memory read Affected: before 3.7.2; 4.0.0 before 4.2.2 |
| CVE-2025-12035 | 6.5 | Dec 15 | Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP Affected: before 4.3.0 |
| CVE-2025-12890 | 6.5 | Nov 7 | Bluetooth: peripheral: Invalid handling of malformed connection request Affected: before 4.2.0 |
| CVE-2025-10456 | 6.5 | Sep 19 | Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests Affected: before 3.7.2; 4.0.0 before 4.3.0 |
| CVE-2025-7403 | 6.5 | Sep 19 | Bluetooth: bt_conn_tx_processor unsafe handling Affected: before 4.2.0 |
| CVE-2024-8798 | 6.5 | Dec 15 | Bluetooth: classic: avdtp: missing buffer length check Affected: through 3.7 |
| CVE-2024-6444 | 6.5 | Oct 4 | Bluetooth: ots: missing buffer length check Affected: through 3.6 |
| CVE-2024-6443 | 6.5 | Oct 4 | zephyr: out-of-bound read in utf8_trunc Affected: through 3.6 |
| CVE-2024-6442 | 6.5 | Oct 4 | Bluetooth: ASCS Unchecked tailroom of the response buffer Affected: through 3.6 |
| CVE-2024-6259 | 6.5 | Sep 13 | BT: HCI: adv_ext_report Improper discarding in adv_ext_report Affected: through 3.6 |
| CVE-2024-6137 | 6.5 | Sep 13 | BT: Classic: SDP OOB access in get_att_search_list Affected: through 3.6 |
| CVE-2024-6135 | 6.5 | Sep 13 | BT:Classic: Multiple missing buf length checks Affected: through 3.6 |
| CVE-2024-5931 | 6.5 | Sep 13 | BT: Unchecked user input in bap_broadcast_assistant Affected: through 3.6 |
| CVE-2024-6258 | 6.5 | Sep 13 | BT: Missing length checks of net_buf in rfcomm_handle_data Affected: through 3.6 |
| CVE-2024-5754 | 6.5 | Sep 13 | BT: Encryption procedure host vulnerability Affected: through 3.6 |
| CVE-2024-4785 | 6.5 | Aug 19 | BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero Affected: through 3.6 |
| CVE-2024-3332 | 6.5 | Jul 3 | bt: host/smp: DoS caused by null pointer dereference Affected: through 3.6 |
| CVE-2024-3077 | 6.5 | Mar 29 | Bluetooth: integer underflow in gatt_find_info_rsp Affected: through 3.6 |
| CVE-2023-4258 | 6.5 | Sep 25 | bt: mesh: vulnerability in provisioning protocol implementation on provisionee side Affected: 1.14 through 3.4 |
| CVE-2026-5589 | 6.3 | Jun 4 | Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. Affected: before 4.3.1 |
| CVE-2026-1681 | 6.1 | May 12 | net: Stack Overflow with Ping (to own IP Address) via Shell Affected: before 4.4.0 |
| CVE-2026-4179 | 6.1 | Mar 14 | stm32: usb: Infinite while loop in Interrupt Handler Affected: before 3.7.2; 4.0.0 before 4.2.2; 4.3.0 before 4.3.1 |
| CVE-2026-1677 | 5.3 | May 11 | net: TLS 1.2 connections allowed on TLS 1.3 sockets Affected: before 4.4.0 |
| CVE-2026-5590 | 5.3 | Apr 5 | net: ip/tcp: Null pointer dereference can be triggered by a race condition Affected: before 4.3.1 |
Showing 27