Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,391All CVEsplus 18,889 rejected
- 411Last 24 hours2,991 in the last 7 days
- 17,365Last 30 days1,590 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 63 | 117 | 24 | 0 | 205 | 205 |
| Title | ||
|---|---|---|
| CVE-2026-87044 | Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of servicezephyrproject · zephyr | Medium6.5 |
| CVE-2026-87043 | sys_rand_get() silently returns an unwritten buffer when the entropy device is not readyzephyrproject · zephyr | Medium4.8 |
| CVE-2026-87041 | Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memoryzephyrproject · zephyr | High7.8 |
| CVE-2026-87040 | Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and writezephyrproject · zephyr | High8.3 |
| CVE-2026-87039 | I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to driverszephyrproject · zephyr | High7.8 |
| CVE-2026-87038 | Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modezephyrproject · zephyr | High7.0 |
| CVE-2026-16511 | Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memoryzephyrproject · zephyr | High8.8 |
| CVE-2026-85036 | Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queuezephyrproject · zephyr | Medium5.7 |
| CVE-2026-85035 | Use-after-free via dynamically allocated message queue retained by the CAN RX filterzephyrproject · zephyr | High8.8 |
| CVE-2026-85034 | Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscriberszephyrproject · zephyr | Medium6.7 |
| CVE-2026-85033 | Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peerzephyrproject · zephyr | Medium4.6 |
| CVE-2026-85032 | Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progresszephyrproject · zephyr | Medium4.8 |
| CVE-2026-82962 | Out-of-bounds write in Zephyr Ethernet L2 when adding the link-layer header to a forwarded packetzephyrproject · zephyr | Medium6.5 |
| CVE-2026-82961 | Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user modezephyrproject · zephyr | High7.8 |
| CVE-2026-82390 | Cross-session AES key confusion in the Espressif ESP32 hardware crypto driverzephyrproject · zephyr | Low3.7 |
| CVE-2026-82389 | Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereferencezephyrproject · zephyr | Medium6.5 |
| CVE-2026-82388 | Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic hostzephyrproject · zephyr | Medium5.3 |
| CVE-2026-19742 | IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret keyzephyrproject · zephyr | Low3.7 |
| CVE-2026-81038 | Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responseszephyrproject · zephyr | High7.1 |
| CVE-2026-81039 | Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identityzephyrproject · zephyr | Medium4.3 |
| CVE-2026-79982 | Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet sizezephyrproject · zephyr | High8.8 |
| CVE-2026-79981 | DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofingzephyrproject · zephyr | Medium6.5 |
| CVE-2026-79980 | Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNSzephyrproject · zephyr | Medium5.6 |
| CVE-2026-79979 | Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frameszephyrproject · zephyr | High7.8 |
| CVE-2026-79978 | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read pathzephyrproject · zephyr | Low3.6 |
| CVE-2026-79977 | WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyrzephyrproject · zephyr | High8.2 |
| CVE-2026-19741 | OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)zephyrproject · zephyr | High7.5 |
| CVE-2026-19947 | Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexerzephyrproject · zephyr | Medium5.3 |
| CVE-2026-79976 | NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controllerzephyrproject · zephyr | High7.1 |
| CVE-2026-78119 | Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet lengthzephyrproject · zephyr | Medium6.3 |
| CVE-2026-78118 | Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMPzephyrproject · zephyr | High7.0 |
| CVE-2026-78117 | Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the airzephyrproject · zephyr | Medium4.2 |
| CVE-2026-18748 | Out-of-bounds read in Bluetooth Classic A2DP codec information element handlingzephyrproject · zephyr | Low3.5 |
| CVE-2026-78116 | Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error pathzephyrproject · zephyr | Medium5.2 |
| CVE-2026-19676 | PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user modezephyrproject · zephyr | High7.8 |
| CVE-2026-77684 | Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of servicezephyrproject · zephyr | Medium5.7 |
| CVE-2026-19595 | Zephyr RTIO syscall verifier validates output parameters for read instead of write accesszephyrproject · zephyr | Medium6.1 |
| CVE-2026-76788 | Stack out-of-bounds write in the OSDP Control Panel reply parserzephyrproject · zephyr | High8.8 |
| CVE-2026-76787 | NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumzephyrproject · zephyr | Medium5.9 |
| CVE-2026-75085 | Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driverzephyrproject · zephyr | Medium4.2 |
| CVE-2026-75084 | Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet lengthzephyrproject · zephyr | Medium6.8 |
| CVE-2026-19673 | Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN headerzephyrproject · zephyr | High7.1 |
| CVE-2026-75083 | Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driverzephyrproject · zephyr | Medium5.9 |
| CVE-2026-19940 | Bluetooth HFP AG reuses a connection slot while a delayable work item is still armed, corrupting kernel timeout bookkeepingzephyrproject · zephyr | Medium6.5 |
| CVE-2026-19939 | Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruptionzephyrproject · zephyr | Medium6.3 |
| CVE-2026-19938 | Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command failszephyrproject · zephyr | Medium5.9 |
| CVE-2026-19937 | Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responseszephyrproject · zephyr | Medium5.7 |
| CVE-2026-19936 | Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereferencezephyrproject · zephyr | Medium4.8 |
| CVE-2026-19740 | Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedurezephyrproject · zephyr | Medium6.5 |
| CVE-2026-19739 | Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Updatezephyrproject · zephyr | Medium6.5 |