Browse All CVEs
50,487 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-19938 |
medium | 5.9 | 0.0016 | 2026-11-04 | The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fail | |
CVE-2026-19937 |
medium | 5.7 | 0.0018 | 2026-11-04 | The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delay | |
CVE-2026-19936 |
medium | 4.8 | 0.0014 | 2026-11-04 | The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable | |
CVE-2026-19935 |
high | 7.5 | 0.0018 | 2026-11-04 | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for def | |
CVE-2026-19740 |
medium | 6.5 | 0.0010 | 2026-11-04 | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE | |
CVE-2026-19739 |
medium | 6.5 | 0.0010 | 2026-11-04 | The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_l | |
CVE-2026-19738 |
medium | 6.5 | 0.0010 | 2026-11-04 | The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous | |
CVE-2026-19736 |
high | 7.8 | 0.0011 | 2026-11-04 | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller' | |
CVE-2026-19735 |
medium | 4.8 | 0.0016 | 2026-11-04 | The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every T | |
CVE-2026-19669 |
high | 7.8 | 0.0018 | 2026-11-04 | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_pr | |
CVE-2026-19576 |
medium | 6.8 | 0.0017 | 2026-11-04 | The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count f | |
CVE-2026-19575 |
high | 7.8 | 0.0012 | 2026-11-04 | The user-mode verification handler for the device_deinit() system call, z_vrfy_device_dein | |
CVE-2026-19574 |
high | 7.0 | 0.0010 | 2026-11-04 | The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with | |
CVE-2026-19571 |
medium | 6.7 | 0.0009 | 2026-11-04 | The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_bac | |
CVE-2026-19570 |
high | 8.8 | 0.0029 | 2026-11-04 | The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup | |
CVE-2026-19569 |
high | 8.8 | 0.0018 | 2026-11-04 | dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation fo | |
CVE-2026-19186 |
high | 8.1 | 0.0021 | 2026-11-04 | ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed p | |
CVE-2026-15894 |
high | 8.8 | 0.0031 | 2026-11-04 | The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/s | |
CVE-2026-19185 |
high | 7.8 | 0.0017 | 2026-11-04 | The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the oute | |
CVE-2026-19184 |
high | 8.4 | 0.0010 | 2026-11-04 | The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequ | |
CVE-2026-17053 |
medium | 4.4 | 0.0009 | 2026-11-04 | The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() | |
CVE-2026-18747 |
medium | 6.1 | 0.0024 | 2026-11-04 | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length | |
CVE-2026-18746 |
medium | 5.9 | 0.0026 | 2026-11-04 | parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRI | |
CVE-2026-17052 |
high | 7.8 | 0.0016 | 2026-11-04 | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/ | |
CVE-2026-17051 |
medium | 6.0 | 0.0016 | 2026-11-04 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an i | |
CVE-2026-17050 |
medium | 5.7 | 0.0023 | 2026-11-04 | The experimental USB host stack allocates a per-device configuration-descriptor buffer, ud | |
CVE-2026-16515 |
medium | 4.7 | 0.0025 | 2026-11-04 | net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 44 | |
CVE-2026-16512 |
low | 3.1 | 0.0021 | 2026-11-04 | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header retur | |
CVE-2026-16148 |
medium | 4.6 | 0.0023 | 2026-11-04 | The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work wi | |
CVE-2026-15893 |
medium | 6.5 | 0.0033 | 2026-11-04 | net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reacha | |
CVE-2026-15923 |
medium | 4.6 | 0.0023 | 2026-11-04 | The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finish | |
CVE-2026-15891 |
high | 7.5 | 0.0057 | 2026-11-04 | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c re | |
CVE-2026-15460 |
medium | 5.4 | 0.0025 | 2026-11-04 | The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetoot | |
CVE-2026-14697 |
medium | 6.5 | 0.0029 | 2026-11-04 | net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor | |
CVE-2026-14368 |
medium | 5.4 | 0.0027 | 2026-11-04 | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c co | |
CVE-2026-14367 |
low | 3.1 | 0.0014 | 2026-11-04 | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work n | |
CVE-2026-14366 |
medium | 6.4 | 0.0025 | 2026-11-04 | The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/si | |
CVE-2026-13481 |
medium | 5.4 | 0.0024 | 2026-11-04 | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP | |
CVE-2026-13479 |
low | 3.1 | 0.0023 | 2026-11-04 | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync | |
CVE-2026-13478 |
medium | 5.5 | 0.0014 | 2026-11-04 | The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (su | |
CVE-2026-13217 |
medium | 5.9 | 0.0067 | 2026-11-04 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id | |
CVE-2026-13216 |
medium | 6.1 | 0.0026 | 2026-11-04 | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list | |
CVE-2026-13215 |
medium | 6.8 | 0.0028 | 2026-11-04 | The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-d | |
CVE-2026-13214 |
critical | 9.8 | 0.0090 | 2026-11-04 | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in pa | |
CVE-2026-13213 |
medium | 5.3 | 0.0025 | 2026-11-04 | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a co | |
CVE-2026-13212 |
high | 8.8 | 0.0037 | 2026-11-04 | The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio de | |
CVE-2026-9728 |
medium | 6.4 | 0.0011 | 2026-11-04 | The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validate | |
CVE-2026-12999 |
medium | 5.3 | 0.0025 | 2026-11-04 | The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infi | |
CVE-2026-12634 |
medium | 5.3 | 0.0014 | 2026-11-04 | The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) read | |
CVE-2026-12633 |
high | 8.1 | 0.0031 | 2026-11-04 | The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context |