Z
Vendor security profile
zephyrproject
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs166
Critical4
CISA KEV0
Public exploit63
Patch rate%100
Avg. CVSS6.2
12-month vulnerability rate
0
0
0
0
0
1
4
30
27
57
26
21
CVE KEV
CVE severity distribution
166toplam CVE
Critical4 (2%)
High54 (33%)
Medium90 (54%)
Low18 (11%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%38
Public exploit
166Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
6.5
CVE-2026-19740
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
Z
Patch verified
6.5
CVE-2026-19739
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
Z
Patch verified
6.5
CVE-2026-19738
Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures
Z
Patch verified
7.5
CVE-2026-19935
Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown
Z
Patch verified
5.5
CVE-2026-19737
NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
Z
Patch verified
3.4
CVE-2026-18418
Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name
Z
Patch verified
7.8
CVE-2026-19736
Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths
Z
Patch verified
4.8
CVE-2026-19735
Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack
Z
Patch verified
7.1
CVE-2026-19577
Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address
Z
Patch verified
6.8
CVE-2026-19576
Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count
Z
Patch verified