# cve.now: Everest

The newest entries naming Everest as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-33015](https://cve.now/CVE-2026-33015.md): EVerest has RemoteStop Bypass via BCB Toggle Session Restart (CVSS 5.2)
- [CVE-2026-33014](https://cve.now/CVE-2026-33014.md): EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop (CVSS 5.2)
- [CVE-2026-33009](https://cve.now/CVE-2026-33009.md): EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio (CVSS 8.2)
- [CVE-2026-29044](https://cve.now/CVE-2026-29044.md): EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted (CVSS 5.0)
- [CVE-2026-27828](https://cve.now/CVE-2026-27828.md): EVerest: ISO15118 session\_setup use-after-free can crash EVSE process (CVSS 5.5)
- [CVE-2026-27816](https://cve.now/CVE-2026-27816.md): EVerest's ISO15118 update\_energy\_transfer\_modes overflow can corrupt EVSE state (CVSS 5.5)
- [CVE-2026-27815](https://cve.now/CVE-2026-27815.md): EVerest: ISO15118 session\_setup payment options overflow can corrupt EVSE state (CVSS 5.5)
- [CVE-2026-27814](https://cve.now/CVE-2026-27814.md): EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition (CVSS 4.2)
- [CVE-2026-27813](https://cve.now/CVE-2026-27813.md): EVerest has use-after-free in auth timeout timer via race condition (CVSS 5.3)
- [CVE-2026-26074](https://cve.now/CVE-2026-26074.md): EVerest: OCPP201 startup event\_queue lock mismatch leads to std::map/std::queue data race (CVSS 7.0)
- [CVE-2026-26073](https://cve.now/CVE-2026-26073.md): EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event\_queue (CVSS 5.9)
- [CVE-2026-26072](https://cve.now/CVE-2026-26072.md): EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse\_soc\_map (CVSS 4.2)
- [CVE-2026-26071](https://cve.now/CVE-2026-26071.md): EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free (CVSS 4.2)
- [CVE-2026-26070](https://cve.now/CVE-2026-26070.md): EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash (CVSS 4.6)
- [CVE-2026-26008](https://cve.now/CVE-2026-26008.md): EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes (CVSS 7.5)
- [CVE-2026-23995](https://cve.now/CVE-2026-23995.md): EVerest has stack buffer overflow in ifreq.ifr\_name when interface name exceeds IFNAMSIZ (CVSS 8.4)
- [CVE-2026-22790](https://cve.now/CVE-2026-22790.md): EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup\_payload (CVSS 8.8)
- [CVE-2026-22593](https://cve.now/CVE-2026-22593.md): EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing (CVSS 8.4)
- [CVE-2026-24003](https://cve.now/CVE-2026-24003.md): EvseV2G has sequence state validation bypass (CVSS 4.3)
- [CVE-2025-68141](https://cve.now/CVE-2025-68141.md): EVerest vulnerable to null pointer dereference during DC\_ChargeLoopRes document deserialization (CVSS 7.4)
- [CVE-2025-68140](https://cve.now/CVE-2025-68140.md): EVerest allows null session ID to bypass session ID verification (CVSS 4.3)
- [CVE-2025-68139](https://cve.now/CVE-2025-68139.md): In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing (CVSS 4.3)
- [CVE-2025-68138](https://cve.now/CVE-2025-68138.md): EVerest affected by memory exhaustion in libocpp (CVSS 4.7)
- [CVE-2026-23955](https://cve.now/CVE-2026-23955.md): EVerest vulnerable to concatenation of strings literal and integers (CVSS 4.2)
- [CVE-2025-68137](https://cve.now/CVE-2025-68137.md): EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop (CVSS 8.4)
- [CVE-2025-68136](https://cve.now/CVE-2025-68136.md): EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service (CVSS 7.4)
- [CVE-2025-68135](https://cve.now/CVE-2025-68135.md): EVerest's inadequate exception handling leads to denial of service (CVSS 6.5)
- [CVE-2025-68134](https://cve.now/CVE-2025-68134.md): EVerest's use of assert functions can potentially lead to denial of service (CVSS 7.4)
- [CVE-2025-68132](https://cve.now/CVE-2025-68132.md): EVerest has out-of-bounds read in DZG\_GSH01 SLIP CRC parser that can crash powermeter driver (CVSS 2.4)
- [CVE-2025-68133](https://cve.now/CVE-2025-68133.md): EVerest's unlimited connections can lead to DoS through operating system resource exhaustion (CVSS 7.4)
- [CVE-2025-59399](https://cve.now/CVE-2025-59399.md): libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error message generation. (CVSS 3.1)
- [CVE-2025-59398](https://cve.now/CVE-2025-59398.md): The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 255 characters, becau (CVSS 3.1)
- [CVE-2024-37310](https://cve.now/CVE-2024-37310.md): EVerest has an integer overflow in the "v2g\_incoming\_v2gtp" function (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/everest
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.