Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102728 | high | 7.5 | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS client's HelloVerif... | 2026-11-04 |
| CVE-2026-102727 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data port without c... | 2026-11-04 |
| CVE-2026-102726 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each opti... | 2026-11-04 |
| CVE-2026-102725 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list l... | 2026-11-04 |
| CVE-2026-102724 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP par... | 2026-11-04 |
| CVE-2026-102723 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through... | 2026-11-04 |
| CVE-2026-95649 | not reported | — | No | IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or... | 2026-11-04 |
| CVE-2026-94460 | not reported | — | No | IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileges with a predi... | 2026-11-04 |
| CVE-2026-94459 | not reported | — | No | IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installatio... | 2026-11-04 |
| CVE-2026-102722 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever ad... | 2026-11-04 |
| CVE-2026-102721 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet without boundi... | 2026-11-04 |
| CVE-2026-102720 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte less than its rea... | 2026-11-04 |
| CVE-2026-102719 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies from NX_RAND(),... | 2026-11-04 |
| CVE-2026-102711 | not reported | — | No | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the size... | 2026-11-04 |
| CVE-2024-33605 | high | 7.5 | No | Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path traversal vulnerabilit... | 2026-11-04 |
| CVE-2026-87044 | medium | 6.5 | No | The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In mbedtls_cbc() an... | 2026-11-04 |
| CVE-2026-87043 | medium | 4.8 | No | The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as d... | 2026-11-04 |
| CVE-2026-87041 | high | 7.8 | No | The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated th... | 2026-11-04 |
| CVE-2026-92615 | medium | 6.6 | No | A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which... | 2026-11-04 |
| CVE-2026-87040 | high | 8.3 | No | The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU again... | 2026-11-04 |