OpenEVSE
ESP32 firmware for the OpenEVSE electric-vehicle charging station.
Vulnerabilities affecting this build
16reported by a scanner that checks NVD
31reported by Firmpath
15only in vendors' own advisories, or not yet in NVD for this version
4to upgrade
7to look at
3clear
38no advisory source
To upgrade
mbedtls 3.6.6 Upgrade to 3.6.7 or later14 vulnerabilities · an NVD scanner reports 1
- CVE-2026-50580 mbedtls missed by NVD scannershigh
Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake
- CVE-2026-50579 mbedtls missed by NVD scannershigh
Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context
- CVE-2026-50713 mbedtls missed by NVD scannershigh
Heap corruption with early renegotiation after corrupted record in DTLS
- CVE-2026-50584 mbedtls missed by NVD scannersmedium
ChaCha20 counter overflow can reuse keystream
- CVE-2026-50587 mbedtls missed by NVD scannersmedium
Timing side-channel in RSA PKCS#1 v1.5 decryption
- CVE-2026-50640 mbedtls missed by NVD scannerslow
Ignored TLS 1.3 resumption secret derivation error
- CVE-2026-50583 mbedtls missed by NVD scannerslow
Out-of-bounds read when parsing a zero-length ECC public key
- CVE-2026-50586 mbedtls missed by NVD scannerslow
Information disclosure in TLS 1.2 NewSessionTicket
- CVE-2026-73096 mbedtls missed by NVD scannersmedium
TLS 1.3 early data integrity failure due to buffered plaintext across key change
- CVE-2026-50585 mbedtls missed by NVD scannersmedium
Incomplete context reset in mbedtls_ssl_session_reset()
- CVE-2026-54441 mbedtls missed by NVD scannerslow
Signature algorithm restrictions not enforced on certificate chain
- CVE-2026-73064 mbedtls missed by NVD scannerslow
A random generator fault can compromise TLS data integrity
- CVE-2025-66442 mbedtls low
Compiler-induced constant-time violations
- CVE-2026-50588 mbedtls missed by NVD scannerslow
Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing
nimble 1.6.0 Upgrade to 1.10.0 or later12 vulnerabilities · an NVD scanner reports 12
- CVE-2026-45815 nimble high
Remote reachable assertion in ATT Read Multiple Variable Response handler
- CVE-2025-52435 nimble high
Invalid error handling in pause encryption procedure in NimBLE controller
- CVE-2024-51569 nimble high
Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
- CVE-2026-45813 nimble high
Incorrect data validation in BASS add/modify source operation
- CVE-2024-24746 nimble high
Denial of service in NimBLE Bluetooth stack
- CVE-2026-45811 nimble high
Buffer overflow in socket HCI transport
- CVE-2025-53477 nimble high
NULL Pointer Dereference in NimBLE host HCI layer
- CVE-2026-45816 nimble high
NULL pointer dereference vulnerability in SMP LTK request
- CVE-2026-45812 nimble medium
OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
- CVE-2024-47249 nimble medium
Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
- CVE-2026-46452 nimble medium
Mesh Proxy SAR reassembly unbounded append and unchecked failure
- CVE-2025-53470 nimble low
Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
nghttp2 1.58.0 Upgrade to 1.68.1 or later3 vulnerabilities · an NVD scanner reports 3
- CVE-2026-27135 Siemens high
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
- CVE-2024-28182 medium
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.6
- CVE-2026-58055 medium
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header an
esp-idf 5.5.5 Upgrade to 6.1.1 or later2 vulnerabilities · an NVD scanner reports 0
- CVE-2026-81508 espressif missed by NVD scannersmedium
Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
- CVE-2020-26142 espressif missed by NVD scannersmedium
Vulnerable Espressif WLAN device processes every single fragmented AMPDU frame as an independent and a full frame
To look at
lwip 2.2.0 A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 1
- CVE-2020-22283 silabs high
Buffer overflow vulnerability via a crafted ICMPv6 message may lead to accessing sensitive information
openthread 2026.07.0.. A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 0
- CVE-2023-2626 openthread missed by NVD scannershigh
Missing Key ID Mode validation when processing 6LoWPAN frames
libexpat version not stated Bundled in an SDK with no version of its own. Check the advisories.63 vulnerabilities · an NVD scanner reports 63
- CVE-2016-0718 critical
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
- CVE-2022-22822 critical
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2022-22823 critical
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2022-22824 critical
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2022-23852 critical
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_
- CVE-2022-25235 critical
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UT
- CVE-2022-25236 critical
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace
- CVE-2022-25315 critical
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
- CVE-2024-45491 critical
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on
- CVE-2024-45492 critical
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_grou
- CVE-2016-5300 high
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attacker
- CVE-2016-4472 high
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke
- CVE-2017-9233 high
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
- CVE-2017-11742 high
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local us
- CVE-2018-20843 high
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XM
- CVE-2019-15903 high
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
- CVE-2021-45960 high
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can le
- CVE-2021-46143 high
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
- CVE-2022-22825 high
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2022-22826 high
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2022-22827 high
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2022-23990 high
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
- CVE-2022-25314 high
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
- CVE-2022-40674 high
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
- CVE-2022-43680 high
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
- CVE-2023-52425 high
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in th
- CVE-2024-28757 high
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via
- CVE-2024-45490 high
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
- CVE-2026-66046 high
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAt
- CVE-2026-25210 Hitachi Energy medium
Hitachi Energy RTU500
- CVE-2026-32776 Hitachi Energy medium
Hitachi Energy RTU500
- CVE-2026-32777 Hitachi Energy medium
Hitachi Energy RTU500
- CVE-2009-3720 medium
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and o
- CVE-2009-3560 medium
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows con
- CVE-2012-0876 medium
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash c
- CVE-2012-1147 medium
readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor con
- CVE-2012-1148 medium
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to
- CVE-2013-0340 medium
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
- CVE-2015-1283 medium
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.24
- CVE-2012-6702 medium
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-d
- CVE-2022-25313 medium
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth
- CVE-2023-52426 medium
libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
- CVE-2024-50602 medium
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_Stop
- CVE-2026-50219 medium
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_Pars
- CVE-2026-56131 medium
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a
- CVE-2026-56132 medium
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array
- CVE-2026-56403 medium
libexpat before 2.8.2 has an integer overflow in storeAtts.
- CVE-2026-56404 medium
libexpat before 2.8.2 has an integer overflow in addBinding.
- CVE-2026-56405 medium
libexpat before 2.8.2 has an integer overflow in getAttributeId.
- CVE-2026-56406 medium
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse
- CVE-2026-56407 medium
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
- CVE-2026-56408 medium
libexpat before 2.8.2 has an integer overflow in copyString.
- CVE-2026-56409 medium
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
- CVE-2026-56410 medium
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
- CVE-2026-56411 medium
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
- CVE-2026-56412 medium
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking
- CVE-2026-76956 medium
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, w
- CVE-2026-76957 medium
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur
- CVE-2025-66382 Siemens low
Siemens SINEC OS
- CVE-2026-24515 Hitachi Energy low
Hitachi Energy RTU500
- CVE-2026-32778 Hitachi Energy low
Hitachi Energy RTU500
- CVE-2026-41080 low
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
- CVE-2026-45186 low
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via
libcoap version not stated Bundled in an SDK with no version of its own. Check the advisories.16 vulnerabilities · an NVD scanner reports 16
- CVE-2023-30362 high
Buffer Overflow vulnerability in coap_send function in libcoap library 4.3.1-103-g52cfd56 fixed in 4.3.1-120-ge242200 al
- CVE-2024-31031 high
An issue in `coap_pdu.c` in libcoap 4.3.4 allows attackers to cause undefined behavior via a sequence of messages leadin
- CVE-2025-65493 high
NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of servic
- CVE-2025-65494 high
NULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attacker
- CVE-2025-65495 high
Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers t
- CVE-2025-34468 high
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address re
- CVE-2026-29013 high
libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in
- CVE-2023-35862 medium
libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.
- CVE-2024-0962 medium
A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function g
- CVE-2025-65496 medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack
- CVE-2025-65497 medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack
- CVE-2025-65498 medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack
- CVE-2025-65499 medium
Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause
- CVE-2025-65500 medium
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack
- CVE-2025-65501 medium
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of
- CVE-2025-59391 medium
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patche
tinyxml2 version not stated Bundled in an SDK with no version of its own. Check the advisories.3 vulnerabilities · an NVD scanner reports 3
- CVE-2018-11210 critical
TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml
- CVE-2024-50614 medium
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XM
- CVE-2024-50615 medium
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp
cryptoauthlib version not stated Bundled in an SDK with no version of its own. Check the advisories.2 vulnerabilities · an NVD scanner reports 2
- CVE-2019-16129 medium
Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).
- CVE-2019-16128 medium
Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).
coex-lib version not stated Bundled in an SDK with no version of its own. Check the advisories.1 vulnerability · an NVD scanner reports 0
- CVE-2021-26706 silabs missed by NVD scannersmedium
Update to “BadAlloc” Security Vulnerability in Micrium OS Dynamic Memory Pool Allocations
No advisory source
- adafruit-mcp9808-library 2.0.2
- adafruit-neopixel 1.15.5
- arduinojson 6.20.1
- arduinomongoose 0.04..1.0.0
- asio
- cmock v2.5.2-2-geeecc49ce8af
- configjson 0.0.8
- epoxyduino
- esp-ble-mesh-lib
- esp-ieee802154-lib
- esp-phy-lib
- esp-thread-lib
- esp-tsdb 2.4.3
- esp32-bt-lib
- esp32-wifi-lib
- esp32c2-bt-lib
- esp32c3-bt-lib
- esp32c5-bt-lib
- esp32c6-bt-lib
- esp32h2-bt-lib
- espal 0.0.7
- esptool
- libsodium
- lvgl 8.4.0
- micro-debug 0.0.5
- microocpp 1.2.0
- microocppmongoose 1.2.0
- microtasks 0.0.4
- mqtt
- openevse 0.0.24
- spiffs 0.2-265-gad902ca
- streamspy 0.0.2
- tft-espi
- tinycbor
- tinyusb
- tlsf
- unity v2.6.0-RC1
- ws2812fx 1.4.7
How this was made, and what it is not
We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.
It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.