Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12519 | medium | 5.0 | No | The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a... | 2026-11-04 |
| CVE-2026-12364 | high | 8.4 | No | The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pass-through: it forwarded the c... | 2026-11-04 |
| CVE-2026-12363 | medium | 4.2 | No | The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a r... | 2026-11-04 |
| CVE-2026-12236 | medium | 6.5 | No | The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response recei... | 2026-11-04 |
| CVE-2026-12235 | medium | 6.3 | No | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relocatable (partially-linked) ELF... | 2026-11-04 |
| CVE-2026-12233 | medium | 5.9 | No | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex... | 2026-11-04 |
| CVE-2026-12052 | medium | 5.2 | No | The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-siz... | 2026-11-04 |
| CVE-2026-121803 | critical | — | No | Rejected reason: This CVE ID is a duplicate of CVE-2026-80335 (VULN-002 dl_download_midst) and has been rejected. | 2026-11-04 |
| CVE-2026-11812 | low | 2.5 | No | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structu... | 2026-11-04 |
| CVE-2026-11811 | low | 3.7 | No | The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on... | 2026-11-04 |
| CVE-2026-11810 | high | 7.5 | No | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata... | 2026-11-04 |
| CVE-2026-11809 | low | 3.7 | No | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_prob... | 2026-11-04 |
| CVE-2026-11743 | medium | 6.6 | No | The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write... | 2026-11-04 |
| CVE-2026-11742 | low | 3.6 | No | The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag... | 2026-11-04 |
| CVE-2026-112668 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-112541 | high | 7.8 | No | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.... | 2026-11-04 |
| CVE-2026-10849 | high | 7.5 | No | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buff... | 2026-11-04 |
| CVE-2026-10686 | high | 7.5 | No | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_rou... | 2026-11-04 |
| CVE-2026-112493 | high | 7.8 | No | A downgrade issue was addressed with additional version checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS T... | 2026-11-04 |
| CVE-2026-112437 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |