Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-14367 | low | 3.1 | No | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free i... | 2026-11-04 |
| CVE-2026-14366 | medium | 6.4 | No | The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a network packet it doe... | 2026-11-04 |
| CVE-2026-13481 | medium | 5.4 | No | The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(),... | 2026-11-04 |
| CVE-2026-13479 | medium | 4.3 | No | The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock... | 2026-11-04 |
| CVE-2026-13478 | medium | 5.5 | No | The Zephyr ext2 filesystem driver validates the on-disk block bitmap in ext2_init_fs() (subsys/fs/ext2/ext2_impl.c) by passing fs_blocks = s... | 2026-11-04 |
| CVE-2026-13217 | medium | 5.9 | No | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In oc... | 2026-11-04 |
| CVE-2026-13594 | critical | 9.1 | No | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversa... | 2026-11-04 |
| CVE-2026-13216 | medium | 6.1 | No | The virtio PCI driver (drivers/virtio/virtio_pci.c) parses a device's PCI capability list during driver initialization. In virtio_pci_read_c... | 2026-11-04 |
| CVE-2026-13215 | medium | 6.8 | No | The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_ve... | 2026-11-04 |
| CVE-2026-13214 | critical | 9.8 | No | The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfigurat... | 2026-11-04 |
| CVE-2026-13213 | medium | 5.3 | No | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_... | 2026-11-04 |
| CVE-2026-13212 | high | 8.8 | No | The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (d... | 2026-11-04 |
| CVE-2026-12999 | medium | 5.3 | No | The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c allocates a net_buf from the fix... | 2026-11-04 |
| CVE-2026-12634 | medium | 5.3 | No | The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-name entries into fixed 74-byte s... | 2026-11-04 |
| CVE-2026-12633 | high | 8.1 | No | The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Rout... | 2026-11-04 |
| CVE-2026-12632 | medium | 6.5 | No | Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off t... | 2026-11-04 |
| CVE-2026-12631 | medium | 6.5 | No | The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through th... | 2026-11-04 |
| CVE-2026-12629 | medium | 4.6 | No | The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, b... | 2026-11-04 |
| CVE-2026-12522 | high | 8.8 | No | The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses... | 2026-11-04 |
| CVE-2026-12520 | medium | 6.4 | No | The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and... | 2026-11-04 |