Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: zephyrproject zephyr 4.3.2, 4.5.0 Clear all filters
TI-2026-80481 CVE-2026-82390

Cross-session AES key confusion in Espressif ESP32 hardware crypto driver

Priority LOW 17

The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (default 4) independent sessions, each carrying its own key and d…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00198 Published 2026-10-26 Fixed in 4.3.2, 4.5.0 CWE-362
TI-2026-80474 CVE-2026-19742

IPv6 interface identifiers derived from a predictable random key in Zephyr

Priority LOW 17

The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (gen_temporary_iid() in subsy…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00248 Published 2026-10-26 Fixed in 4.3.2, 4.5.0 CWE-338
TI-2026-80477 CVE-2026-81038

Bluetooth OTS server leaks uninitialized stack memory in Zephyr

Priority LOW 30

The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/services/ots/ots_oacp.c).

CVSS 3.1HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00148 Published 2026-10-26 Fixed in 4.3.2, 4.5.0 CWE-617