Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-18746 | medium | 5.9 | No | parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For... | 2026-11-04 |
| CVE-2026-18416 | medium | 5.3 | No | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI c... | 2026-11-04 |
| CVE-2026-18415 | high | 7.1 | No | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame... | 2026-11-04 |
| CVE-2026-18414 | high | 7.8 | No | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_se... | 2026-11-04 |
| CVE-2026-18413 | high | 7.8 | No | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_se... | 2026-11-04 |
| CVE-2026-17053 | medium | 4.4 | No | The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smb... | 2026-11-04 |
| CVE-2026-16513 | high | 7.8 | No | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) vali... | 2026-11-04 |
| CVE-2026-17052 | high | 7.8 | No | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated... | 2026-11-04 |
| CVE-2026-17051 | medium | 6.0 | No | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). I... | 2026-11-04 |
| CVE-2026-17050 | medium | 5.7 | No | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap i... | 2026-11-04 |
| CVE-2026-16515 | medium | 4.7 | No | net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an... | 2026-11-04 |
| CVE-2026-15894 | high | 8.8 | No | The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU i... | 2026-11-04 |
| CVE-2026-16512 | low | 3.1 | No | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_typ... | 2026-11-04 |
| CVE-2026-16148 | medium | 4.6 | No | The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, su... | 2026-11-04 |
| CVE-2026-15923 | medium | 4.6 | No | The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size =... | 2026-11-04 |
| CVE-2026-14697 | medium | 6.5 | No | net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitation. When it is called with a data packe... | 2026-11-04 |
| CVE-2026-14368 | medium | 5.4 | No | The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into a caller-supplied b... | 2026-11-04 |
| CVE-2026-15893 | medium | 6.5 | No | net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_rea... | 2026-11-04 |
| CVE-2026-15891 | high | 7.5 | No | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are... | 2026-11-04 |
| CVE-2026-15460 | medium | 5.4 | No | The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c dispatched inbound data... | 2026-11-04 |