CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage root@kitploit: python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931

The Zephyr Project Manager WordPress plugin (all versions up to and including 3.3.205 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'message' parameter , caused by insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher can in...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

EUVD-2026-72696

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

PT-2026-87033

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931: Improper Neutralization of Input During Web Page Generation

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

WordPress Zephyr Project Manager plugin <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Zephyr Project Manager versions = 3.3.205...

CVE-2026-10849

The CVE concerns the hawkBit OTA client in Zephyr (subsys/mgmt/hawkbit/hawkbit.c). A heap-based out-of-bounds write occurs when terminating the received HTTP body: the buffer holds the body but no space for a NUL, so response_data[downloaded_size] = '\0' writes past the allocation. This is trigge...

CVE-2026-10678

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...

CVE-2026-10680

CVE-2026-10680 affects Zephyr Project’s Classic BR/EDR L2CAP signaling: l2cap_br_conf_req() and l2cap_br_conf_rsp() validate the per-command length against the whole PDU length (buf-&gt;len) instead of the per-command len, allowing underflow of opt_len and an out-of-bounds read/write during confi...

CVE-2026-10678 NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...

CVE-2026-10666

parseipv4 in subsys/net/ip/utils.c reached via netipaddrparse for strings of the form "a.b.c.d:port" copies the port substring into a fixed 17-byte stack buffer char ipaddrNETIPV4ADDRLEN + 1 using a length of strlen - end - 1, where strlen is the full, unbounded input length and end is only the...

CVE-2026-10663

In Zephyr's experimental USB host stack CONFIGUSBHOSTSTACK, usbhdevicedisconnect subsys/usb/host/usbhdevice.c freed the root usbdevice slab object without clearing the cached pointer ctx-root. The bus removal handler devremovedhandler subsys/usb/host/usbhcore.c decides what to tear down solely fr...

CVE-2026-10657

The CVE-2026-10657 vulnerability affects Zephyr's DNS resolver when MDNS (CONFIG_MDNS_RESOLVER) is enabled. The code uses memcmp(strrchr(query, '.'), ".local", 7) to detect mDNS queries, reading a fixed 7 bytes from the suffix pointer. If the final label is shorter than 7 bytes (e.g., .org, .com,...

CVE-2026-10687

This CVE Record has been rejected by the Zephyr Project CNA. Subsequent analysis, confirmed with the fix author, determined that the addressed defect does not apply to any released version of Zephyr: the affected code path exists only in unreleased development code, and no released branch is...

PT-2026-49108

CVE-2026-10676 - Rejected reason: This CVE Record has been rejected CVE ID :CVE-2026-10676 Published : June 12, 2026, 12:16 a.m. | 1 hour, 14 minutes ago Description :Rejected reason: This CVE Record has been rejected by the Zephyr Project CNA. Subsequent analysis determined that the addressed...

CVE-2026-5072

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTPMSGMANAGEMENT message to set an unvalidated negative logannounceinterval value in the port's data set. When a subsequent...

WordPress Zephyr Project Manager plugin <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation vulnerability

Authenticated Subscriber+ Limited Privilege Escalation vulnerability discovered by wesley wcraft in WordPress Plugin Zephyr Project Manager versions = 3.3.101...