Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

dns: memory‑safety issue in the DNS name parser

Out of bounds read in dns_copy_qname

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

Out of bounds read when unpacking DNS answers

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

Userspace privilege escalation vulnerability on Cortex M

Bluetooth: Out-Of-Context le_conn_rsp Handling

can: Local Denial of Service via SocketCAN Send

net: eswifi socket send payload length not bounded

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

Infinite loop in dns_copy_qname

can: denial-of-service can be triggered by a crafted CAN frame

crypto: ATAES132A response length allows stack buffer overflow

ptp: Potential Denial of Service via PTP Interval Shift

net: icmp: Out of bound memory read

Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

Bluetooth: peripheral: Invalid handling of malformed connection request

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

Bluetooth: bt_conn_tx_processor unsafe handling

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

net: Stack Overflow with Ping (to own IP Address) via Shell

stm32: usb: Infinite while loop in Interrupt Handler

net: TLS 1.2 connections allowed on TLS 1.3 sockets

net: ip/tcp: Null pointer dereference can be triggered by a race condition