Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-20547 | high | 7.5 | No | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE... | 2026-11-04 |
| CVE-2026-20545 | high | 7.5 | No | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE... | 2026-11-04 |
| CVE-2026-20499 | high | 7.5 | No | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE... | 2026-11-04 |
| CVE-2026-19940 | medium | 6.5 | No | The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag o... | 2026-11-04 |
| CVE-2026-19939 | medium | 6.3 | No | The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP req... | 2026-11-04 |
| CVE-2026-19742 | low | 3.7 | No | The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ip... | 2026-11-04 |
| CVE-2026-19938 | medium | 5.9 | No | The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c docu... | 2026-11-04 |
| CVE-2026-19937 | medium | 5.7 | No | The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH... | 2026-11-04 |
| CVE-2026-19936 | medium | 4.8 | No | The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, fre... | 2026-11-04 |
| CVE-2026-19935 | high | 7.5 | No | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded... | 2026-11-04 |
| CVE-2026-19741 | high | 7.5 | No | Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously... | 2026-11-04 |
| CVE-2026-19740 | medium | 6.5 | No | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried... | 2026-11-04 |
| CVE-2026-19739 | medium | 6.5 | No | The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while... | 2026-11-04 |
| CVE-2026-19738 | medium | 6.5 | No | The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->no... | 2026-11-04 |
| CVE-2026-19736 | high | 7.8 | No | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TR... | 2026-11-04 |
| CVE-2026-19676 | high | 7.8 | No | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device... | 2026-11-04 |
| CVE-2026-19595 | medium | 6.1 | No | The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff... | 2026-11-04 |
| CVE-2026-19735 | medium | 4.8 | No | The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus... | 2026-11-04 |
| CVE-2026-19669 | high | 7.8 | No | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_han... | 2026-11-04 |
| CVE-2026-19576 | medium | 6.8 | No | The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it... | 2026-11-04 |