What’s Vulnerable › Products
everest-core vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.
Check whether your everest-core version is affected
Latest everest-core vulnerabilities
- CVE-2026-33015 — EVerest has RemoteStop Bypass via BCB Toggle Session Restart (CVSS 5.2)
- CVE-2026-33014 — EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop (CVSS 5.2)
- CVE-2026-33009 — EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio (CVSS 6.5)
- CVE-2026-29044 — EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted (CVSS 6.5)
- CVE-2026-27828 — EVerest: ISO15118 session_setup use-after-free can crash EVSE process (CVSS 7.5)
- CVE-2026-27816 — EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state (CVSS 9.1)
- CVE-2026-27815 — EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state (CVSS 9.1)
- CVE-2026-27814 — EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition (CVSS 4.2)
- CVE-2026-27813 — EVerest has use-after-free in auth timeout timer via race condition (CVSS 5.3)
- CVE-2026-26074 — EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race (CVSS 7.0)
- CVE-2026-26073 — EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue (CVSS 5.9)
- CVE-2026-26072 — EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map (CVSS 4.2)
- CVE-2026-26071 — EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free (CVSS 4.2)
- CVE-2026-26070 — EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash (CVSS 4.2)
- CVE-2026-26008 — EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes (CVSS 7.5)
- CVE-2026-23995 — EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ (CVSS 7.8)
- CVE-2026-22790 — EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload (CVSS 8.8)
- CVE-2026-22593 — EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing (CVSS 7.8)
- CVE-2026-24003 — EvseV2G has sequence state validation bypass (CVSS 5.3)
- CVE-2026-23955 — EVerest vulnerable to concatenation of strings literal and integers (CVSS 4.2)
- CVE-2025-68141 — EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization (CVSS 7.4)
- CVE-2025-68140 — EVerest allows null session ID to bypass session ID verification (CVSS 4.3)
- CVE-2025-68139 — In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing (CVSS 4.3)
- CVE-2025-68137 — EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop (CVSS 8.3)
- CVE-2025-68136 — EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service (CVSS 7.4)