en
The Zephyr Project is a Linux Foundation-hosted open-source collaboration that develops Zephyr, a small, scalable real-time operating system for connected and resource-constrained embedded devices. It brings together a global community of silicon vendors, product manufacturers, software vendors, and developers.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/20/2026, zephyrproject recorded 124 security vulnerabilities in the last 90 days across 1 products, including 33 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, zephyr had the most security vulnerabilities in the zephyrproject ecosystem, with 124 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-77684Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of serviceCVE-2026-19595Zephyr RTIO syscall verifier validates output parameters for read instead of write accessCVE-2026-76788Stack out-of-bounds write in the OSDP Control Panel reply parserCVE-2026-76787NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumCVE-2026-75085Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver299 Results | Page 1 of 30
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |