Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19741 | high | 7.5 | No | Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously... | 2026-11-04 |
| CVE-2026-19740 | medium | 6.5 | No | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried... | 2026-11-04 |
| CVE-2026-19739 | medium | 6.5 | No | The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while... | 2026-11-04 |
| CVE-2026-19738 | medium | 6.5 | No | The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->no... | 2026-11-04 |
| CVE-2026-19736 | high | 7.8 | No | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TR... | 2026-11-04 |
| CVE-2026-19676 | high | 7.8 | No | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device... | 2026-11-04 |
| CVE-2026-19595 | medium | 6.1 | No | The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff... | 2026-11-04 |
| CVE-2026-19735 | medium | 4.8 | No | The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus... | 2026-11-04 |
| CVE-2026-19669 | high | 7.8 | No | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_han... | 2026-11-04 |
| CVE-2026-19576 | medium | 6.8 | No | The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it... | 2026-11-04 |
| CVE-2026-19575 | high | 7.8 | No | The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argumen... | 2026-11-04 |
| CVE-2026-19574 | high | 7.0 | No | The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_ini... | 2026-11-04 |
| CVE-2026-19571 | medium | 6.7 | No | The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command req... | 2026-11-04 |
| CVE-2026-19570 | high | 8.8 | No | The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement... | 2026-11-04 |
| CVE-2026-19569 | high | 8.8 | No | dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_siz... | 2026-11-04 |
| CVE-2026-18748 | low | 3.5 | No | The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte... | 2026-11-04 |
| CVE-2026-19186 | high | 8.1 | No | ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - a... | 2026-11-04 |
| CVE-2026-19185 | high | 7.8 | No | The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data b... | 2026-11-04 |
| CVE-2026-19184 | high | 8.4 | No | The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, ag... | 2026-11-04 |
| CVE-2026-18747 | medium | 6.8 | No | The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally... | 2026-11-04 |