CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...

CVE-2026-19740

The Zephyr software Bluetooth LE Controller contains a vulnerability in its Link Layer Control Procedure (LLCP) implementation. Specifically, the functions llcp_lp_pu_rx() and llcp_rp_pu_rx() in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c fail to release a retained receive node when processi...

CVE-2026-19935

The Zephyr Bluetooth host is vulnerable to a use-after-free flaw in the L2CAP connection-oriented channel (CoC) object. When using a dynamic PSM (0x0080-0x00FF), the system queues received data for deferred processing via a k_work item. However, during channel teardown in l2cap_chan_destroy(), th...

CVE-2026-19735

The Zephyr TCP stack contains a vulnerability where the RFC 6528 initial-sequence-number (ISN) implementation may use predictable values. If the sys_csrand_get() call fails during early boot (e.g., due to -ENODEV or -EIO from the entropy driver), the system fails to catch the error and leaves the...

vulns

vulnerability reports HN Security's advisories. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Multiple vulnerabilities in Solaris dtprintinfo and libXm/libXpm CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Multiple vulnerabilities in Zyxel zysh...

signy

signy Signed URLs for small devices. Background signy is a library for generating signed URLs on embedded devices using asymmetric cryptography. Signed URLs are typically utilized to grant time-limited access to private resources, such as those served by a Content Delivery Network CDN. In the...

vulns

Segnalazioni di vulnerabilità Avvisi di HN Security. https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Diverse vulnerabilità in Solaris dtprintinfo e libXm/libXpm CVE-2022-46285, CVE-2023-24039, CVE-2023-24040. Zyxel HNS-2022-02-zyxel-zysh. Diverse vulnerabilità in Zyxel zysh CVE-2022-26531...

CVE-2026-19569

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

EUVD-2026-95529

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-19569

An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...

CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-8023

CVE-2026-8023 — Travesía de ruta en HTTP static-fs de Zephyr PoC Travesía de ruta sin autenticación en el manejador static-fs del servidor HTTP de Zephyr subsys/net/lib/http cuando se usa coincidencia de recursos comodín CONFIGHTTPSERVERRESOURCEWILDCARD=y con HTTPRESOURCETYPESTATICFS. Afecta tant...

zephyr-lwm2m-firmware-update-oob-read-cve-2026-10672-truncated-package-uri

CVE-2026-10672 — Prueba de Concepto de Lectura Fuera de Límites en la Actualización de Firmware LwM2M de Zephyr Prueba de concepto para CVE-2026-10672 , una lectura fuera de límites en el cliente de extracción de actualización de firmware LwM2M de Zephyr RTOS...

zephyr_cve-2021-3625

CVE-2021-3625 This repository contains a few example exploits for CVE-2021-3625. All Zephyr-based usb devices up to and including version 2.5.0 suffer from a buffer overflow allowing readout of up to 65kB. Depending on the actual device this may result of leakage of sensitive data like encryption...

CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

zephyr

ElasticSearch index map examples This directory contains ElasticSearch data store index map examples for use by uploadtestresultses.py script for Twister JSON reports upload. An index map file allows to create destination index files on ElasticSearch server with explicit scheme having all require...

PT-2026-104749

The NXP GAU ADC driver drivers/adc/adc mcux gau adc.c validated the caller-supplied sequence-buffer size, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-results length and used it in mcux gau adc read...

CVE-2026-17053

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...