Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112434 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-10685 | high | 7.6 | No | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's p... | 2026-11-04 |
| CVE-2026-10683 | medium | 4.6 | No | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_r... | 2026-11-04 |
| CVE-2026-10681 | high | 7.0 | No | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated a new thread permission index... | 2026-11-04 |
| CVE-2026-10678 | high | 8.1 | No | The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus m... | 2026-11-04 |
| CVE-2026-10667 | high | 7.8 | No | Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list... | 2026-11-04 |
| CVE-2026-10672 | critical | 9.1 | No | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_... | 2026-11-04 |
| CVE-2026-10664 | medium | 5.0 | No | The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied... | 2026-11-04 |
| CVE-2026-10658 | high | 7.1 | No | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU hea... | 2026-11-04 |
| CVE-2026-10643 | high | 7.8 | No | Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary... | 2026-11-04 |
| CVE-2026-10651 | medium | 6.5 | No | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the... | 2026-11-04 |
| CVE-2026-10645 | medium | 5.5 | No | The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a dire... | 2026-11-04 |
| CVE-2026-10642 | medium | 6.5 | No | The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invo... | 2026-11-04 |
| CVE-2026-10641 | high | 7.1 | No | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bound... | 2026-11-04 |
| CVE-2026-10593 | medium | 6.5 | No | The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_e... | 2026-11-04 |
| CVE-2026-0053 | high | 8.4 | No | In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation... | 2026-11-04 |
| CVE-2026-49293 | high | 7.5 | No | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.1 parse hexadecimal / oc... | 2026-11-04 |
| CVE-2026-45109 | high | 7.5 | No | Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix a... | 2026-11-04 |
| CVE-2026-44009 | critical | 9.8 | No | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to w... | 2026-11-04 |
| CVE-2026-44008 | critical | 9.8 | No | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other... | 2026-11-04 |