Which CVEs affect ESP-IDF 6.1?
No CVE listed.
What changed against ESP-IDF 6.0.1?
1 CVE of 6.0.1 are no longer listed for 6.1: CVE-2026-45160.
No CVE was added in 6.1.
What does the number mean for a device?
Counted are the CVEs public sources name for ESP-IDF version 6.1. "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Questions
How many CVEs does ESP-IDF 6.1 have?
As of 13 Nov 2026, the sources checked name no CVE for ESP-IDF 6.1.
From which version are the CVEs of ESP-IDF 6.1 fixed?
No CVE is listed for ESP-IDF 6.1.