Y
Vendor security profile
y_project
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs2
Critical0
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS5.2
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
0
2
CVE KEV
CVE severity distribution
2toplam CVE
Medium2 (100%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
2Unknown
Latest vulnerabilities
5.3
CVE-2026-108803
y_project RuoYi Disable API add changeStatus session expiration
Y
Patch status unknown
5.1
CVE-2026-108802
y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting
Y
Patch status unknown
6.5
CVE-2026-19740
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
Z
Patch verified
6.5
CVE-2026-19739
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
Z
Patch verified
6.5
CVE-2026-19738
Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
Z
Patch verified
7.5
CVE-2026-19935
Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown
Z
Patch verified
5.5
CVE-2026-19737
NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
Z
Patch verified
3.4
CVE-2026-18418
Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
Z
Patch verified
7.8
CVE-2026-19736
Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths
Z
Patch verified
4.8
CVE-2026-19735
Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
Z
Patch verified