Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-11810 | high | 7.5 | No | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata... | 2026-11-04 |
| CVE-2026-11809 | low | 3.7 | No | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_prob... | 2026-11-04 |
| CVE-2026-11743 | medium | 6.6 | No | The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write... | 2026-11-04 |
| CVE-2026-11742 | low | 3.6 | No | The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag... | 2026-11-04 |
| CVE-2026-112668 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-112541 | high | 7.8 | No | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.... | 2026-11-04 |
| CVE-2026-112530 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-10849 | high | 7.5 | No | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buff... | 2026-11-04 |
| CVE-2026-10686 | high | 7.5 | No | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_rou... | 2026-11-04 |
| CVE-2026-112493 | high | 7.8 | No | A downgrade issue was addressed with additional version checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS T... | 2026-11-04 |
| CVE-2026-112437 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-112434 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-10685 | high | 7.6 | No | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's p... | 2026-11-04 |
| CVE-2026-10683 | medium | 4.6 | No | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_r... | 2026-11-04 |
| CVE-2026-10681 | high | 7.0 | No | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index... | 2026-11-04 |
| CVE-2026-10678 | high | 8.1 | No | The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus m... | 2026-11-04 |
| CVE-2026-10667 | high | 7.8 | No | Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list... | 2026-11-04 |
| CVE-2026-10672 | critical | 9.1 | No | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_... | 2026-11-04 |
| CVE-2026-10666 | critical | 9.8 | No | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into... | 2026-11-04 |
| CVE-2026-10664 | medium | 5.0 | No | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied... | 2026-11-04 |