Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13213 | medium | 5.3 | No | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_... | 2026-11-04 |
| CVE-2026-13212 | high | 8.8 | No | The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (d... | 2026-11-04 |
| CVE-2026-12999 | medium | 5.3 | No | The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fix... | 2026-11-04 |
| CVE-2026-12634 | medium | 5.3 | No | The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte s... | 2026-11-04 |
| CVE-2026-12633 | high | 8.1 | No | The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Rout... | 2026-11-04 |
| CVE-2026-12632 | medium | 6.5 | No | Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off t... | 2026-11-04 |
| CVE-2026-12631 | medium | 6.5 | No | The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through th... | 2026-11-04 |
| CVE-2026-12629 | medium | 4.6 | No | The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, b... | 2026-11-04 |
| CVE-2026-12522 | high | 8.8 | No | The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses... | 2026-11-04 |
| CVE-2026-12520 | medium | 6.4 | No | The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and... | 2026-11-04 |
| CVE-2026-12519 | medium | 5.0 | No | The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a... | 2026-11-04 |
| CVE-2026-12364 | high | 8.4 | No | The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the c... | 2026-11-04 |
| CVE-2026-12363 | medium | 4.2 | No | The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a r... | 2026-11-04 |
| CVE-2026-12236 | medium | 6.5 | No | The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response recei... | 2026-11-04 |
| CVE-2026-12235 | medium | 6.3 | No | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF... | 2026-11-04 |
| CVE-2026-12233 | medium | 5.9 | No | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex... | 2026-11-04 |
| CVE-2026-12052 | medium | 5.2 | No | The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-siz... | 2026-11-04 |
| CVE-2026-121803 | critical | — | No | Rejected reason: This CVE ID is a duplicate of CVE-2026-80335 (VULN-002 dl_download_midst) and has been rejected. | 2026-11-04 |
| CVE-2026-11812 | low | 2.5 | No | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structu... | 2026-11-04 |
| CVE-2026-11811 | low | 3.7 | No | The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on... | 2026-11-04 |