Arduino
10 CVEs across 9 Arduino products. Browse Arduino vulnerabilities, severities, and proof-of-concept exploits.
Arduino products with known CVEs
Arduino CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-25933 | Medium | 6.8 | 2026-02-12 | Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-ap… |
CVE-2025-69209 | | | 2026-01-21 | ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.7 allows an attac… |
CVE-2025-64724 | High | 7.3 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensit… |
CVE-2025-64723 | Medium | 4.4 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements… |
CVE-2025-27608 | | | 2025-04-02 | Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within… |
CVE-2023-49296 | Medium | 6.3 | 2023-12-13 | The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vul… |
CVE-2023-43801 | Medium | 6.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles… |
CVE-2023-43800 | High | 7.3 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the abi… |
CVE-2023-43803 | Medium | 6.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles… |
CVE-2023-43802 | High | 7.1 | 2023-10-18 | Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filenam… |
CVE-2019-13991 | Medium | 6.5 | 2019-07-19 | Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photose… |