zephyrproject
Number 83 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
219
Critical
2
High
68
Known Exploited
0
Exploit available
0
Network, no login needed
18.7%
Of 219 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 219 | 2 | 68 | 124 | 25 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| zephyr | 219 | 70 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 136 | 51 |
| dos | 31 | 0 |
| Race Condition | 13 | 3 |
| memory-safety | 9 | 7 |
| crypto | 5 | 0 |
| Missing Authorization | 4 | 1 |
| Denial of Service | 3 | 0 |
| Type Confusion | 3 | 1 |
| Authentication Issues | 2 | 1 |
| Information Disclosure | 2 | 0 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-90834 | UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode | Medium | n/a | |
| CVE-2026-90833 | Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode | High | n/a | |
| CVE-2026-90832 | Out-of-bounds read in Bluetooth Host periodic advertising report reassembly due to unvalidated report length | Medium | n/a | |
| CVE-2026-87042 | Zephyr PTP: unvalidated Delay_Resp message interval lets an on-link peer wedge the PTP thread and flood the network | Medium | n/a | |
| CVE-2026-82391 | Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length | Critical | n/a | |
| CVE-2026-77685 | Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write | High | n/a | |
| CVE-2026-90591 | NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop | High | 0.3% | |
| CVE-2026-90590 | Permanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link drop | Medium | 0.2% | |
| CVE-2026-90589 | Memory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address space | Medium | 0.1% | |
| CVE-2026-90588 | Out-of-bounds read in Zephyr HTTP client debug logging of response header fields | Low | 0.2% |