Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87039 | high | 7.8 | No | The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct i2s_config in from user memor... | 2026-11-04 |
| CVE-2026-87038 | high | 7.0 | No | The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the ca... | 2026-11-04 |
| CVE-2026-85036 | medium | 5.7 | No | The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in subsys/bluetooth/host/clas... | 2026-11-04 |
| CVE-2026-54099 | high | 8.8 | No | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validate... | 2026-11-04 |
| CVE-2026-16511 | high | 8.8 | No | Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied point... | 2026-11-04 |
| CVE-2025-13327 | medium | 6.3 | No | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specia... | 2026-11-04 |
| CVE-2025-11229 | high | 7.2 | No | The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications... | 2026-11-04 |
| CVE-2026-9728 | medium | 6.4 | No | The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading... | 2026-11-04 |
| CVE-2026-9771 | high | 8.8 | No | The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this... | 2026-11-04 |
| CVE-2026-95209 | medium | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further i... | 2026-11-04 |
| CVE-2026-95210 | medium | 4.8 | No | GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) in... | 2026-11-04 |
| CVE-2026-8718 | high | 8.4 | No | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VAL... | 2026-11-04 |
| CVE-2026-8023 | high | 7.5 | No | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_F... | 2026-11-04 |
| CVE-2026-88648 | low | 3.7 | No | In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulner... | 2026-11-04 |
| CVE-2026-95184 | medium | 5.9 | No | GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although... | 2026-11-04 |
| CVE-2026-86936 | high | 7.8 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A... | 2026-11-04 |
| CVE-2026-84545 | high | 8.8 | No | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, mac... | 2026-11-04 |
| CVE-2026-88647 | medium | 6.5 | No | GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (... | 2026-11-04 |
| CVE-2026-7007 | medium | 4.6 | No | The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/ext2_impl.c) before completing... | 2026-11-04 |
| CVE-2026-7656 | medium | 6.8 | No | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boole... | 2026-11-04 |