ZE
Product
zephyr
29
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 14Medium 12Low 0
Watch
Add zephyr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5068 | 8.8 | Jun 9 | bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data Affected: 1.14.0 before 4.3.1 |
| CVE-2026-5066 | 8.8 | Jun 4 | net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function Affected: before 3.7.2; 4.0.0 before 4.2.2; 4.3.0 before 4.3.1 |
| CVE-2025-1674 | 8.2 | Feb 25 | Out of bounds read when unpacking DNS answers Affected: before 3.7.2; 4.0.0 before 4.1.0 |
| CVE-2025-1673 | 8.2 | Feb 25 | Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg Affected: before 3.7.2; 4.0.0 before 4.1.0 |
| CVE-2025-9408 | 8.1 | Nov 11 | Userspace privilege escalation vulnerability on Cortex M Affected: before 3.7.2; 4.0.0 before 4.2.2 |
| CVE-2025-10457 | 8.1 | Sep 19 | Bluetooth: Out-Of-Context le_conn_rsp Handling Affected: before 4.3.0 |
| CVE-2026-5071 | 7.8 | May 30 | can: Local Denial of Service via SocketCAN Send Affected: before 3.7.2; 4.0.0 before 4.2.2; 4.3.0 before 4.3.1 |
| CVE-2026-1679 | 7.8 | Mar 27 | net: eswifi socket send payload length not bounded Affected: before 4.4.0 |
| CVE-2025-9557 | 7.6 | Nov 26 | Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont Affected: before 4.2.2 |
| CVE-2025-9558 | 7.6 | Nov 26 | Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start Affected: before 4.2.2 |
| CVE-2025-10458 | 7.6 | Sep 19 | Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values Affected: before 4.3.0 |
| CVE-2026-13351 | 7.5 | Jun 25 | net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets Affected: before 3.7.2; 4.0.0 before 4.2.2; 4.3.0 before 4.3.1 |
| CVE-2025-2962 | 7.5 | Jun 24 | Infinite loop in dns_copy_qname Affected: before 3.7.2; 4.0.0 before 4.2.0 |
| CVE-2022-2741 | 7.5 | Oct 31 | can: denial-of-service can be triggered by a crafted CAN frame Affected: through v3.1 |
Showing 14