Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16515 | medium | 4.7 | No | net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an... | 2026-11-04 |
| CVE-2026-15894 | high | 8.8 | No | The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU i... | 2026-11-04 |
| CVE-2026-16512 | low | 3.1 | No | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_typ... | 2026-11-04 |
| CVE-2026-16148 | medium | 4.6 | No | The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, su... | 2026-11-04 |
| CVE-2026-15923 | medium | 4.6 | No | The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size =... | 2026-11-04 |
| CVE-2026-14697 | medium | 6.5 | No | net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packe... | 2026-11-04 |
| CVE-2026-14368 | medium | 5.4 | No | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied b... | 2026-11-04 |
| CVE-2026-15893 | medium | 6.5 | No | net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_rea... | 2026-11-04 |
| CVE-2026-15891 | high | 7.5 | No | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are... | 2026-11-04 |
| CVE-2026-15460 | medium | 5.4 | No | The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data... | 2026-11-04 |
| CVE-2026-14367 | low | 3.1 | No | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free i... | 2026-11-04 |
| CVE-2026-14366 | medium | 6.4 | No | The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it doe... | 2026-11-04 |
| CVE-2026-13481 | medium | 5.4 | No | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(),... | 2026-11-04 |
| CVE-2026-13479 | medium | 4.3 | No | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock... | 2026-11-04 |
| CVE-2026-13478 | medium | 5.5 | No | The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s... | 2026-11-04 |
| CVE-2026-13217 | medium | 5.9 | No | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In oc... | 2026-11-04 |
| CVE-2026-13594 | critical | 9.1 | No | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversa... | 2026-11-04 |
| CVE-2026-13216 | medium | 6.1 | No | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_c... | 2026-11-04 |
| CVE-2026-13215 | medium | 6.8 | No | The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_ve... | 2026-11-04 |
| CVE-2026-13214 | critical | 9.8 | No | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfigurat... | 2026-11-04 |