Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0

Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver

IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key

WireGuard keepalive transport-data messages accepted without Poly1305 authentication

Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS

UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata

Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`)

Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path

Cross-thread FPU register leak on ARM when FPU enabled without register sharing

Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock

Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name

Information leakage in le_ecred_conn_req()

Invalid channel map in CONNECT_IND results to Deadlock

Security problem with settings and littlefs

Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames

I3C IBI work-node free-list data race between ISR and workqueue thread

Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic

Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer

Out-of-bounds read in coredump shell when printing stored-dump target code

UpdateHub: race condition on shared context causes out-of-bounds write and DoS