Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-9771 | high | 8.8 | No | The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this... | 2026-11-04 |
| CVE-2026-95209 | medium | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further i... | 2026-11-04 |
| CVE-2026-95210 | medium | 4.8 | No | GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) in... | 2026-11-04 |
| CVE-2026-8718 | high | 8.4 | No | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VAL... | 2026-11-04 |
| CVE-2026-8023 | high | 7.5 | No | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_F... | 2026-11-04 |
| CVE-2026-88648 | low | 3.7 | No | In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulner... | 2026-11-04 |
| CVE-2026-95184 | medium | 5.9 | No | GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although... | 2026-11-04 |
| CVE-2026-82962 | medium | 6.5 | No | ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it into the headroom of the... | 2026-11-04 |
| CVE-2026-82961 | high | 7.8 | No | The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not validate the pin argument supplied by a user-mode caller. z_vrfy_gpio_pin_... | 2026-11-04 |
| CVE-2026-86936 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-84545 | high | 8.8 | No | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, mac... | 2026-11-04 |
| CVE-2026-88647 | medium | 6.5 | No | GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (... | 2026-11-04 |
| CVE-2026-7007 | medium | 4.6 | No | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing... | 2026-11-04 |
| CVE-2026-7656 | medium | 6.8 | No | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boole... | 2026-11-04 |
| CVE-2026-82390 | low | 3.7 | No | The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AE... | 2026-11-04 |
| CVE-2026-81039 | medium | 4.3 | No | The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it... | 2026-11-04 |
| CVE-2026-81038 | high | 7.1 | No | The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/se... | 2026-11-04 |
| CVE-2026-79982 | high | 8.8 | No | The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HC... | 2026-11-04 |
| CVE-2026-77800 | high | 7.7 | No | ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML... | 2026-11-04 |
| CVE-2026-79978 | low | 3.6 | No | The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of... | 2026-11-04 |