Open-source firmware report

Tasmota

Alternative firmware for ESP32 and ESP8266 smart-home devices.

github.com/arendst/Tasmota · 24 components read from oss-arendst__Tasmota.cdx.json (analysed 2026-10-11) · checked against today's advisories 2026-10-11

Vulnerabilities affecting this build

13reported by a scanner that checks NVD

28reported by Firmpath

15only in vendors' own advisories, or not yet in NVD for this version

3to upgrade

3to look at

3clear

15no advisory source

To upgrade

A published vulnerability affects the version this build uses.

mbedtls 3.6.6 Upgrade to 3.6.7 or later14 vulnerabilities · an NVD scanner reports 1

CVE-2026-50580 mbedtls missed by NVD scannershigh
Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake
mbed-tls.readthedocs.io · cve.org
CVE-2026-50579 mbedtls missed by NVD scannershigh
Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context
mbed-tls.readthedocs.io · cve.org
CVE-2026-50713 mbedtls missed by NVD scannershigh
Heap corruption with early renegotiation after corrupted record in DTLS
mbed-tls.readthedocs.io · cve.org
CVE-2026-50584 mbedtls missed by NVD scannersmedium
ChaCha20 counter overflow can reuse keystream
mbed-tls.readthedocs.io · cve.org
CVE-2026-50587 mbedtls missed by NVD scannersmedium
Timing side-channel in RSA PKCS#1 v1.5 decryption
mbed-tls.readthedocs.io · cve.org
CVE-2026-50640 mbedtls missed by NVD scannerslow
Ignored TLS 1.3 resumption secret derivation error
mbed-tls.readthedocs.io · cve.org
CVE-2026-50583 mbedtls missed by NVD scannerslow
Out-of-bounds read when parsing a zero-length ECC public key
mbed-tls.readthedocs.io · cve.org
CVE-2026-50586 mbedtls missed by NVD scannerslow
Information disclosure in TLS 1.2 NewSessionTicket
mbed-tls.readthedocs.io · cve.org
CVE-2026-73096 mbedtls missed by NVD scannersmedium
TLS 1.3 early data integrity failure due to buffered plaintext across key change
mbed-tls.readthedocs.io · cve.org
CVE-2026-50585 mbedtls missed by NVD scannersmedium
Incomplete context reset in mbedtls_ssl_session_reset()
mbed-tls.readthedocs.io · cve.org
CVE-2026-54441 mbedtls missed by NVD scannerslow
Signature algorithm restrictions not enforced on certificate chain
mbed-tls.readthedocs.io · cve.org
CVE-2026-73064 mbedtls missed by NVD scannerslow
A random generator fault can compromise TLS data integrity
mbed-tls.readthedocs.io · cve.org
CVE-2025-66442 mbedtls low
Compiler-induced constant-time violations
nvd.nist.gov · cve.org
CVE-2026-50588 mbedtls missed by NVD scannerslow
Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing
mbed-tls.readthedocs.io · cve.org

nimble 1.6.0 Upgrade to 1.10.0 or later12 vulnerabilities · an NVD scanner reports 12

CVE-2026-45815 nimble high
Remote reachable assertion in ATT Read Multiple Variable Response handler
nvd.nist.gov · cve.org
CVE-2025-52435 nimble high
Invalid error handling in pause encryption procedure in NimBLE controller
nvd.nist.gov · cve.org
CVE-2024-51569 nimble high
Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
nvd.nist.gov · cve.org
CVE-2026-45813 nimble high
Incorrect data validation in BASS add/modify source operation
nvd.nist.gov · cve.org
CVE-2024-24746 nimble high
Denial of service in NimBLE Bluetooth stack
nvd.nist.gov · cve.org
CVE-2026-45811 nimble high
Buffer overflow in socket HCI transport
nvd.nist.gov · cve.org
CVE-2025-53477 nimble high
NULL Pointer Dereference in NimBLE host HCI layer
nvd.nist.gov · cve.org
CVE-2026-45816 nimble high
NULL pointer dereference vulnerability in SMP LTK request
nvd.nist.gov · cve.org
CVE-2026-45812 nimble medium
OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
nvd.nist.gov · cve.org
CVE-2024-47249 nimble medium
Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
nvd.nist.gov · cve.org
CVE-2026-46452 nimble medium
Mesh Proxy SAR reassembly unbounded append and unchecked failure
nvd.nist.gov · cve.org
CVE-2025-53470 nimble low
Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
nvd.nist.gov · cve.org

esp-idf 5.5.5 Upgrade to 6.1.1 or later2 vulnerabilities · an NVD scanner reports 0

CVE-2026-81508 espressif missed by NVD scannersmedium
Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
github.com · cve.org
CVE-2020-26142 espressif missed by NVD scannersmedium
Vulnerable Espressif WLAN device processes every single fragmented AMPDU frame as an independent and a full frame
espressif.com · cve.org

To look at

Version numbers cannot settle these: usually a vendor's fork that may already carry the fix.

lwip 2.2.0 A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 1

CVE-2020-22283 silabs high
Buffer overflow vulnerability via a crafted ICMPv6 message may lead to accessing sensitive information
nvd.nist.gov · cve.org

openthread 2026.07.0.. A vendor fork: check whether it carries the fixes1 vulnerability · an NVD scanner reports 0

CVE-2023-2626 openthread missed by NVD scannershigh
Missing Key ID Mode validation when processing 6LoWPAN frames
github.com · cve.org

coex-lib version not stated Bundled in an SDK with no version of its own. Check the advisories.1 vulnerability · an NVD scanner reports 0

CVE-2021-26706 silabs missed by NVD scannersmedium
Update to “BadAlloc” Security Vulnerability in Micrium OS Dynamic Memory Pool Allocations
raw.githubusercontent.com · cve.org

No advisory source

No vendor advisory, NVD or OSV record has ever named these. That is not the same as safe: nobody is publishing about them.

cmock v2.5.2-2-geeecc49ce8af
esp-ble-mesh-lib
esp-phy-lib
esp-thread-lib
esp32-bt-lib
esp32-wifi-lib
esp32c2-bt-lib
esp32c3-bt-lib
esp32c5-bt-lib
esp32c6-bt-lib
esp32h2-bt-lib
mqtt
spiffs 0.2-265-gad902ca
tlsf
unity v2.6.0-RC1

How this was made, and what it is not

We read the project's build description (manifests, submodules, the SDK it pins), took each SDK release apart into the libraries it bundles, and compared every version with the ranges in vendors' own advisories, NVD and OSV. Every verdict is computed from versions; each finding links to the document it came from. Missed by NVD scanners means a scanner keyed on NVD's CPE records would not report it for this version: no CVE, no NVD record, or NVD files it under another product. The comparison counts only vulnerabilities affecting the version this build uses.

It describes the repository's default build, not any particular binary, and a project may configure out the affected code. It is not an audit. It is recomputed daily as advisories are published. Also as JSON.