Product by Zephyrproject

    Zephyrproject Zephyr

    322 known vulnerabilities in Zephyrproject Zephyr (Zephyrproject), 0 of them actively exploited (CISA KEV).

    Key figures

    322

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    33

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Zephyrproject Zephyr (Zephyrproject)
    CriticalCVE-2020-10071

    Insufficient publish message length validation in MQTT

    also in 1 other product

    9.0
    CriticalCVE-2020-10070

    MQTT buffer overflow on receive buffer

    also in 1 other product

    9.0
    CriticalCVE-2020-10062

    Packet length decoding error in MQTT

    also in 1 other product

    9.0
    CriticalCVE-2021-3625

    Buffer overflow in Zephyr USB DFU DNLOAD

    also in 1 other product

    9.6
    CriticalCVE-2026-13214

    Stack buffer overflow in OCPP GetConfiguration key parsing

    9.8
    CriticalCVE-2020-10022

    UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array

    also in 1 other product

    9.0
    CriticalCVE-2017-14199

    Zephyr Getaddrinfo: Buffer Overflow

    9.8
    CriticalCVE-2018-1000800

    Zephyrproject Zephyr: security vulnerability

    9.8
    CriticalCVE-2026-10666

    Zephyrproject Zephyr: Stack-based Buffer Overflow

    9.8
    CriticalCVE-2026-5067

    Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

    also in 1 other product

    9.8
    HighCVE-2020-10060

    UpdateHub Might Dereference An Uninitialized Pointer

    also in 1 other product

    8.0
    HighCVE-2026-8023

    Zephyrproject Zephyr: Path Traversal

    7.5
    CriticalCVE-2026-10672

    Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

    9.1
    HighCVE-2020-10063

    Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow

    also in 1 other product

    6.8
    CriticalCVE-2022-3806

    Bluetooth HCI Error Handling Double Free

    also in 1 other product

    9.8
    HighCVE-2026-15891

    NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

    7.5
    CriticalCVE-2023-3725

    Potential buffer overflow vulnerability in the Zephyr CANbus subsystem

    also in 1 other product

    7.6
    HighCVE-2026-15894

    Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

    8.8
    HighCVE-2026-19570

    Zephyrproject Zephyr: Classic Buffer Overflow

    8.8
    HighCVE-2026-10665

    Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

    7.4
    HighCVE-2026-76788

    Stack out-of-bounds write in the OSDP Control Panel reply parser

    8.8
    HighCVE-2026-13212

    Zephyrproject Zephyr: Improper Validation of Array Index

    8.8
    HighCVE-2026-79982

    Zephyrproject Zephyr: Out-of-bounds Write

    8.8
    MediumCVE-2026-13217

    NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi

    5.9
    HighCVE-2026-10673

    Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly

    8.8

    All vulnerabilities in search

    News

    All products by Zephyrproject