Zephyrproject
190 CVEs tracked since 2020. Since Jun 2020, none of them reached CISA KEV.
Zephyrproject CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2020-06 | 6 | 0 |
| 2020-07 | null or fewer | |
| 2020-08 | null or fewer | |
| 2020-09 | null or fewer | |
| 2020-10 | null or fewer | |
| 2020-11 | null or fewer | |
| 2020-12 | null or fewer | |
| 2021-01 | null or fewer | |
| 2021-02 | null or fewer | |
| 2021-03 | null or fewer | |
| 2021-04 | null or fewer | |
| 2021-05 | 12 | 0 |
| 2021-06 | null or fewer | |
| 2021-07 | null or fewer | |
| 2021-08 | null or fewer | |
| 2021-09 | null or fewer | |
| 2021-10 | 11 | 0 |
| 2021-11 | null or fewer | |
| 2021-12 | null or fewer | |
| 2022-01 | null or fewer | |
| 2022-02 | null or fewer | |
| 2022-03 | null or fewer | |
| 2022-04 | null or fewer | |
| 2022-05 | null or fewer | |
| 2022-06 | 6 | 0 |
| 2022-07 | null or fewer | |
| 2022-08 | null or fewer | |
| 2022-09 | null or fewer | |
| 2022-10 | null or fewer | |
| 2022-11 | null or fewer | |
| 2022-12 | null or fewer | |
| 2023-01 | 5 | 0 |
| 2023-02 | null or fewer | |
| 2023-03 | null or fewer | |
| 2023-04 | null or fewer | |
| 2023-05 | null or fewer | |
| 2023-06 | null or fewer | |
| 2023-07 | 4 | 0 |
| 2023-08 | null or fewer | |
| 2023-09 | 5 | 0 |
| 2023-10 | 6 | 0 |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | 5 | 0 |
| 2024-03 | null or fewer | |
| 2024-04 | null or fewer | |
| 2024-05 | null or fewer | |
| 2024-06 | null or fewer | |
| 2024-07 | null or fewer | |
| 2024-08 | null or fewer | |
| 2024-09 | 6 | 0 |
| 2024-10 | null or fewer | |
| 2024-11 | null or fewer | |
| 2024-12 | null or fewer | |
| 2025-01 | null or fewer | |
| 2025-02 | 4 | 0 |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | null or fewer | |
| 2026-02 | null or fewer | |
| 2026-03 | null or fewer | |
| 2026-04 | null or fewer | |
| 2026-05 | null or fewer | |
| 2026-06 | 22 | 0 |
| 2026-07 | 28 | 0 |
| 2026-08 | 57 | 0 |
| 2026-09 | 13 | 0 |
Products
The products that kept showing up in Zephyrproject's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Zephyrproject.
- CVE-2026-17054Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly5.3
- CVE-2026-15890AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization5.3
- CVE-2026-17052Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace7.8
- CVE-2026-17051Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length6.0
- CVE-2026-17050Double free of the USB host configuration descriptor when device enumeration fails5.7
- CVE-2026-16515ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack4.7
- CVE-2026-16514Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved4.3
- CVE-2026-16512Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames3.1
- CVE-2026-14986Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction6.8
- CVE-2026-16148Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item4.6
- CVE-2026-16147it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption6.8
- CVE-2026-15924Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets5.9
- CVE-2026-15893Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS6.5
- CVE-2026-15923Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size4.6
- CVE-2026-15892Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service5.3
The record
- Peak rank
- #18 in Aug 2026
- Busiest month shown
- Aug 2026, 57 CVEs
- Months with a KEV entry
- 0 since Jun 2020
- Monthly snapshots
- 15 since 2020