Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

dns: memory‑safety issue in the DNS name parser

Out of bounds read in dns_copy_qname

bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y

Out of bounds read when unpacking DNS answers

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

Userspace privilege escalation vulnerability on Cortex M

Bluetooth: Out-Of-Context le_conn_rsp Handling

can: Local Denial of Service via SocketCAN Send

net: eswifi socket send payload length not bounded

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

Infinite loop in dns_copy_qname

net: lib: http_server: Buffer Under-read

can: denial-of-service can be triggered by a crafted CAN frame

crypto: ATAES132A response length allows stack buffer overflow

ptp: Potential Denial of Service via PTP Interval Shift

net: icmp: Out of bound memory read

Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

Bluetooth: peripheral: Invalid handling of malformed connection request

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

Bluetooth: bt_conn_tx_processor unsafe handling

Bluetooth: classic: avdtp: missing buffer length check

Bluetooth: ots: missing buffer length check

zephyr: out-of-bound read in utf8_trunc

Bluetooth: ASCS Unchecked tailroom of the response buffer

BT: HCI: adv_ext_report Improper discarding in adv_ext_report

BT: Classic: SDP OOB access in get_att_search_list

BT:Classic: Multiple missing buf length checks

BT: Unchecked user input in bap_broadcast_assistant

BT: Missing length checks of net_buf in rfcomm_handle_data

BT: Encryption procedure host vulnerability

BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero

bt: host/smp: DoS caused by null pointer dereference

Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

net: Stack Overflow with Ping (to own IP Address) via Shell

stm32: usb: Infinite while loop in Interrupt Handler

net: TLS 1.2 connections allowed on TLS 1.3 sockets

net: ip/tcp: Null pointer dereference can be triggered by a race condition