CVE-2026-12999 MEDIUM 5.3 Zephyr — The Infineon Airoc Wi-Fi driver's transmit callback airoc_mgmt_send() in drivers/wifi/infineon/airoc_wifi.c al… 2026-08-22 CVE-2026-12522 HIGH 8.8 Zephyr — The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/ven… 2026-08-19 CVE-2026-12633 HIGH 8.1 Zephyr — The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 67… 2026-08-19 CVE-2026-12634 MEDIUM 5.3 Zephyr — The NVS backend of the Zephyr settings subsystem (subsys/settings/src/settings_nvs.c) reads stored setting-nam… 2026-08-19 CVE-2026-12520 MEDIUM 6.4 Zephyr — The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers… 2026-08-18 CVE-2026-12631 MEDIUM 6.5 Zephyr — The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in inclu… 2026-08-18 CVE-2026-12632 MEDIUM 6.5 Zephyr — Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-b… 2026-08-18 CVE-2026-12519 MEDIUM 5 Zephyr — The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/m… 2026-08-17 CVE-2026-12629 MEDIUM 4.6 Zephyr — The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the… 2026-08-17 CVE-2026-12630 MEDIUM 4.3 Zephyr — Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in get_ihpc_in… 2026-08-17 CVE-2026-9771 HIGH 8.8 Zephyr — The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with … 2026-08-17 CVE-2026-12363 MEDIUM 4.2 Zephyr — The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not valida… 2026-08-14 CVE-2026-12364 HIGH 8.4 Zephyr — The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was a pure pa… 2026-08-14 CVE-2026-12365 MEDIUM 5.8 Zephyr — A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayabl… 2026-08-14 CVE-2026-12366 HIGH 8.8 Zephyr — Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's s… 2026-08-14 CVE-2026-12236 MEDIUM 6.5 Zephyr — The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an A… 2026-08-13 CVE-2026-12232 MEDIUM 6.1 Zephyr — The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c … 2026-08-12 CVE-2026-12233 MEDIUM 5.9 Zephyr — The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declar… 2026-08-12 CVE-2026-12234 HIGH 7.8 Zephyr — The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/so…● PoC 2026-08-12 CVE-2026-12235 MEDIUM 6.3 Zephyr — The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries when linking a relo…● PoC 2026-08-12 CVE-2026-11893 MEDIUM 5.9 Zephyr — The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drive… 2026-08-11 CVE-2026-11894 MEDIUM 5.9 Zephyr — The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, vi… 2026-08-11 CVE-2026-11985 LOW 3.6 Zephyr — On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which d… 2026-08-11 CVE-2026-12051 MEDIUM 4.6 Zephyr — The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL p… 2026-08-11 CVE-2026-12052 MEDIUM 5.2 Zephyr — The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usb… 2026-08-11 CVE-2026-11809 LOW 3.7 Zephyr — The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory… 2026-08-10 CVE-2026-11810 HIGH 7.5 Zephyr — The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updateh… 2026-08-10 CVE-2026-11811 LOW 3.7 Zephyr — The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the … 2026-08-10 CVE-2026-11812 LOW 2.5 Zephyr — The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a… 2026-08-10 CVE-2026-8718 HIGH 8.4 Zephyr — tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(…● PoC 2026-08-10 CVE-2026-11742 LOW 3.6 Zephyr — The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q … 2026-08-07 CVE-2026-11743 MEDIUM 6.6 Zephyr — The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset an… 2026-08-07 CVE-2026-11368 HIGH 7.1 Zephyr — The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its ow… 2026-08-04 CVE-2026-10849 HIGH 8.2 Zephyr — The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the … 2026-08-03 CVE-2026-10774 LOW 2.4 Zephyr — Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In s… 2026-08-02 CVE-2026-10848 HIGH 7 Zephyr — The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/o…● PoC 2026-08-02 CVE-2026-10773 MEDIUM 5.4 Zephyr — The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-eleme…● PoC 2026-08-01 CVE-2026-2411 MEDIUM 6.5 Zephyr — Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declara… 2026-08-01 CVE-2026-10685 HIGH 7.6 Zephyr — The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt… 2026-07-31 CVE-2026-10686 MEDIUM 5.8 Zephyr — Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Bot… 2026-07-31 CVE-2026-10684 LOW 3 Zephyr — In subsys/debug/coredump/coredump_shell.c, print_coredump_hdr() used the 16-bit tgt_code field of a stored Zep… 2026-07-29 CVE-2026-10682 MEDIUM 6.6 Zephyr — The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c per… 2026-07-27 CVE-2026-10683 LOW 2.4 Zephyr — In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full inter… 2026-07-27 CVE-2026-10681 MEDIUM 6.5 Zephyr — In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c allocated … 2026-07-25 CVE-2026-7007 MEDIUM 4.6 Zephyr — The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsys/fs/ext2/… 2026-07-24 CVE-2026-10674 MEDIUM 5.5 Zephyr — The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is en… 2026-07-21 CVE-2026-10675 MEDIUM 4.3 Zephyr — In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() resche… 2026-07-21 CVE-2026-10677 MEDIUM 6.5 Zephyr — The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the use… 2026-07-21 CVE-2026-10678 HIGH 8.1 Zephyr — The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-reg… 2026-07-21 CVE-2026-10679 LOW 3.3 Zephyr — The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency… 2026-07-21 CVE-2026-10680 HIGH 7.6 Zephyr — The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/… 2026-07-21 CVE-2026-10673 HIGH 8.3 Zephyr — The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles rece…● PoC 2026-07-15 CVE-2026-10669 HIGH 7.8 Zephyr — On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/m… 2026-07-14 CVE-2026-10670 MEDIUM 5.5 Zephyr — The CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call (z_vrfy_k_thread_name_copy(… 2026-07-14 CVE-2026-10671 HIGH 7.1 Zephyr — In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c u… 2026-07-14 CVE-2026-10672 HIGH 8.2 Zephyr — subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (c…● PoC 2026-07-14 CVE-2026-10663 MEDIUM 6.1 Zephyr — In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usb… 2026-07-12 CVE-2026-10664 MEDIUM 5 Zephyr — The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nr…● PoC 2026-07-12 CVE-2026-10665 HIGH 7.4 Zephyr — In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearize…● PoC 2026-07-12 CVE-2026-10666 HIGH 8.1 Zephyr — parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") …● PoC 2026-07-12 CVE-2026-10667 HIGH 7.8 Zephyr — Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains …● PoC 2026-07-12 CVE-2026-10668 LOW 2.4 Zephyr — The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data… 2026-07-12 CVE-2026-10660 MEDIUM 6.4 Zephyr — The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassemb… 2026-07-11