Zephyr Project
First CVE: Apr 12, 2019Active for: 7 years
176
CVEs Published
More CVEs Published than 78% of tracked CNAs
22.0
Avg CVEs / Year
More Avg CVEs / Year than 70% of tracked CNAs
7.3
Avg CVSS Score
Higher Avg CVSS Score than 59% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Trends Over Time
The number and severity of CVEs published by Zephyr Project over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 12, 2019
7 years ago
Most Recent CVE
Jul 21, 2026
3 days ago
Top CVEs
All CVEs published by Zephyr Project as a CNA, regardless of affected vendor or product.
176 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-10666CRITICAL parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char ipad | Jul 12, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-5067CRITICAL A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header par | Jun 9, 2026 | 9.8 | 39 | NO | NO |
CVE-2026-10643HIGH Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payl | Jun 27, 2026 | 7.8 | 37 | NO | NO |
CVE-2026-10667HIGH Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel object | Jul 12, 2026 | 7.8 | 36 | NO | NO |
CVE-2026-10665HIGH In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG | Jul 12, 2026 | 7.4 | 36 | NO | NO |
CVE-2026-10673HIGH The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device- | Jul 15, 2026 | 8.3 | 35 | NO | NO |
CVE-2026-10672HIGH subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) wit | Jul 14, 2026 | 8.2 | 35 | NO | NO |
CVE-2026-10653HIGH The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-header buf->ref and the per-data-block ref_count at the start of each variable/he | Jun 30, 2026 | 8.1 | 35 | NO | NO |
CVE-2026-9263HIGH The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluet | Jun 30, 2026 | 8.1 | 35 | NO | NO |
CVE-2026-8023HIGH Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabled) that serves files | Jun 29, 2026 | 7.5 | 35 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA176 CVEs
37%
44%
15%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local37 (21.0%)
Network63 (35.8%)
Unknown0 (0.0%)
Physical10 (5.7%)
Adjacent Network66 (37.5%)
Attack Complexity
Low156 (88.6%)
High20 (11.4%)
Unknown0 (0.0%)
User Interaction
None174 (98.9%)
Unknown0 (0.0%)
Required2 (1.1%)
Privileges Required
Low38 (21.6%)
High2 (1.1%)
None136 (77.3%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (176 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by Zephyr Project as a CNA.
Media Mentions
Media articles that mention a CVE ID published by Zephyr Project as a CNA — matched by CVE ID, not by organization name.