| CVE-2026-113421 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full…
|
7.3
High
|
Nov 3, 2026 |
| CVE-2026-115231 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module…
|
8.5
High
|
Nov 3, 2026 |
| CVE-2026-115215 |
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its…
|
8.7
High
|
Nov 2, 2026 |
| CVE-2026-115403 |
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw…
|
8.2
High
|
Nov 2, 2026 |
| CVE-2026-115654 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a…
|
6.9
Medium
|
Nov 2, 2026 |
| CVE-2026-115653 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a…
|
7.0
High
|
Nov 2, 2026 |
| CVE-2026-114408 |
NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full
|
8.7
High
|
Nov 2, 2026 |
| CVE-2026-118052 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without…
|
6.8
Medium
|
Nov 2, 2026 |
| CVE-2026-95107 |
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`
|
7.0
High
|
Oct 20, 2026 |
| CVE-2026-94202 |
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a…
|
4.8
Medium
|
Oct 20, 2026 |
| CVE-2026-95108 |
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one
|
6.8
Medium
|
Oct 20, 2026 |
| CVE-2026-94024 |
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much…
|
6.9
Medium
|
Oct 20, 2026 |
| CVE-2026-94023 |
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one…
|
6.9
Medium
|
Oct 20, 2026 |
| CVE-2026-95109 |
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte
|
8.5
High
|
Oct 20, 2026 |
| CVE-2026-94192 |
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask…
|
8.5
High
|
Oct 20, 2026 |
| CVE-2026-95111 |
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of…
|
4.8
Medium
|
Oct 20, 2026 |
| CVE-2026-102711 |
Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
|
6.9
Medium
|
Sep 29, 2026 |
| CVE-2026-102710 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a…
|
8.5
High
|
Sep 29, 2026 |
| CVE-2026-102709 |
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the…
|
8.4
High
|
Sep 29, 2026 |
| CVE-2026-0648 |
The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in…
|
7.8
High
|
Jan 27, 2026 |