Known Vulnerabilities for Zephyr by Zephyrproject
Listed below are 10 of the newest known vulnerabilities associated with "Zephyr" by "Zephyrproject".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-90257 json | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: avoid OOB read of build info strin... | Not Provided | 2026-09-17 | 2026-10-19 |
| CVE-2026-82961 json | The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z... | Not Provided | 2026-10-28 | 2026-10-28 |
| CVE-2026-82390 json | The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFI... | Not Provided | 2026-10-26 | 2026-10-26 |
| CVE-2026-82388 json | bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_... | Not Provided | 2026-10-26 | 2026-10-26 |
| CVE-2026-76931 json | The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter ... | Not Provided | 2026-09-08 | 2026-09-08 |
| CVE-2026-76788 json | The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral ... | Not Provided | 2026-10-19 | 2026-10-20 |
| CVE-2026-76787 json | The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in z_impl_updatehub_prob... | Not Provided | 2026-10-19 | 2026-10-20 |
| CVE-2026-19947 json | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux... | Not Provided | 2026-10-21 | 2026-10-23 |
| CVE-2026-19741 json | Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thr... | Not Provided | 2026-10-23 | 2026-10-23 |
| CVE-2026-19740 json | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive nod... | Not Provided | 2026-10-11 | 2026-10-16 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Zephyrproject | Zephyr | 2.3.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.3.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.2.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.2.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.2.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.2.0 | |||
| Application | Zephyrproject | Zephyr | 2.2.0 | |||
| Application | Zephyrproject | Zephyr | 2.1.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.1.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.0.0 | |||
| Application | Zephyrproject | Zephyr | 2.0.0 | |||
| Application | Zephyrproject | Zephyr | 2.0.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.0.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.0.0 | |||
| Application | Zephyrproject | Zephyr | 2.0.0 | |||
| Application | Zephyrproject | Zephyr | 2.0.0 | |||
| Operating System | Zephyrproject | Zephyr | 2.0.0 | |||
| Application | Zephyrproject | Zephyr | 1.9.2 | |||
| Operating System | Zephyrproject | Zephyr | 1.9.2 | |||
| Operating System | Zephyrproject | Zephyr | 1.9.1 |