Priority HIGH 82
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00571 · Published 2026-05-12 · Fixed in 3.3.8 CWE-121
Priority HIGH 76
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
CVSS 3.1CRITICAL 10.0· Network · Low privileges · No interaction · EPSS 0.00895 · Published 2024-09-17 · No fix listed CWE-20
Priority HIGH 73
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00307 · Published 2026-04-24 · Fixed in 3.3.8 CWE-121
Priority HIGH 71
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
CVSS 4.0HIGH 8.7· Network · No auth · User interaction · EPSS 0.00334 · Published 2025-07-07 · Fixed in 3.2.1 CWE-352
Priority MEDIUM 64
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.01127 · Published 2024-05-09 · No fix listed CWE-120
Priority MEDIUM 45
arduino-esp32 provides an Arduino core for the ESP32.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.0047 · Published 2025-06-26 · Fixed in 3.2.1, 3.3.0-RC1 CWE-113
Priority MEDIUM 41
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
CVSS 3.1CRITICAL 9.3· Local · No auth · No interaction · EPSS 0.00141 · Published 2026-11-04 · Fixed in 5.5.6, 6.0.4 +1 CWE-787
Priority MEDIUM 41
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
CVSS 3.1CRITICAL 9.3· Local · No auth · No interaction · EPSS 0.00126 · Published 2026-06-10 · No fix listed CWE-20
Priority MEDIUM 41
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
CVSS 4.0HIGH 7.2· Network · No auth · No interaction · EPSS 0.00914 · Published 2025-06-24 · No fix listed CWE-191
Priority MEDIUM 41
ESP-IDF is the official development framework for Espressif SoCs.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00534 · Published 2022-06-25 · Fixed in 4.1.4 CWE-787
Priority MEDIUM 41
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigge…
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.01401 · Published 2021-09-07 · No fix listed
Priority MEDIUM 40
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.007 · Published 2026-07-10 · Fixed in 6.0.2 CWE-121
Priority LOW 39
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00439 · Published 2026-06-10 · No fix listed CWE-476
Priority LOW 39
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00351 · Published 2026-05-12 · Fixed in 3.3.8 CWE-287
Priority LOW 39
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00643 · Published 2025-03-13 · No fix listed CWE-639
Priority LOW 39
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00531 · Published 2024-11-07 · No fix listed CWE-770
Priority LOW 39
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00967 · Published 2024-10-17 · No fix listed CWE-120
Priority LOW 37
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any EAP authentication me…
CVSS 3.0HIGH 8.1· Adjacent network · No auth · No interaction · EPSS 0.00875 · Published 2019-09-04 · No fix listed CWE-327
Priority LOW 36
An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01471 · Published 2021-07-14 · No fix listed
Priority LOW 36
Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btc_blufi_recv_handler function in blufi_p…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01398 · Published 2021-01-12 · No fix listed CWE-120
Priority LOW 35
Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects.
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.00181 · Published 2026-05-28 · Fixed in 1.0.1 CWE-427
Priority LOW 35
ESP-NOW Component provides a connectionless Wi-Fi communication protocol.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00439 · Published 2024-09-12 · Fixed in 2.5.2 CWE-125
Priority LOW 34
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
CVSS 3.1HIGH 8.0· Adjacent network · No auth · User interaction · EPSS 0.00248 · Published 2026-02-04 · No fix listed CWE-191
Priority LOW 33
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
CVSS 3.1MEDIUM 6.8· Physical · High privileges · No interaction · EPSS 0.01356 · Published 2025-03-08 · No fix listed CWE-912
Priority LOW 33
An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0048 · Published 2023-11-09 · No fix listed CWE-326
Load more
THREATIST.IORead the docs