CVE-2026-10772

DUPLICATE This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration...

CVE-2026-2411 Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

EUVD-2026-51869

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

CVE-2026-2411 Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

CVE-2026-2411

CVE-2026-2411 affects Zephyr’s Bluetooth host GATT: when a Characteristic Declaration is used with a value that requires encryption/authentication, the permission check erroneously evaluated the declaration instead of the value, allowing the Notification/Indicate path to bypass encryption require...

CVE-2026-2411 Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

PT-2026-67194

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description Zephyr's Bluetooth host incorrectly handles security permission checks when sending notifications or indications. When a Characteristic Declaration attribute is used, the host evaluates the...

CVE-2026-37554: Uncaught Exception

An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. The vulnerability exists in the GeoNetworking packet processing pipeline where OpenSSL exceptions from ECC point validation invalid compressed point, point not on curve are not...

Vanetza 安全漏洞

Vanetza is an open source implementation of a suite of in-vehicle communication protocols by the individual developer Raphael Riebl. A security vulnerability exists in Vanetza v26.02, which stems from an OpenSSL exception in the GeoNetworking packet processing pipeline that is not correctly caugh...

MAL-2025-45360 Malicious code in not-constantly-indicate (npm)

The package not-constantly-indicate was found to contain malicious code...

Malicious code in salt-surface-indicate (npm)

The package salt-surface-indicate was found to contain malicious code...

MAL-2025-45952 Malicious code in salt-surface-indicate (npm)

The package salt-surface-indicate was found to contain malicious code...

Malicious code in not-constantly-indicate (npm)

The package not-constantly-indicate was found to contain malicious code...

SUSE CVE-2007-5901

Use-after-free vulnerability in the gssindicatemechs function in lib/gssapi/mechglue/ginitialize.c in MIT Kerberos 5 krb5 has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.504.2.el7 - md/raid1: properly indicate failure when ending a failed write request Paul Clements Orabug: 32887159 - video: hypervfb: Add ratelimit on error message Michael Kelley Orabug: 32856879 - Drivers: hv: vmbus: Initialize unloadevent statically Andrea Parri Microsoft Orabug:...

DEBIAN-CVE-2007-5901

Use-after-free vulnerability in the gssindicatemechs function in lib/gssapi/mechglue/ginitialize.c in MIT Kerberos 5 krb5 has unknown impact and attack vectors. NOTE: this might be the result of a typo in the source code...

Microsoft Windows XP20002003 - CreateRemoteThread Local Denial of Service

Microsoft Windows XP20002003 - CreateRemoteThread Local Denial of Service // source: https://www.securityfocus.com/bid/15671/info Microsoft Windows is prone to a local denial of service vulnerability. This issue can allow an attacker to trigger a system wide denial of service condition or termina...