{"resultsPerPage":3,"startIndex":0,"totalResults":3,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-24T00:54:27.055","vulnerabilities":[{"cve":{"id":"CVE-2026-14296","sourceIdentifier":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","published":"2026-09-07T08:17:11.773","lastModified":"2026-09-09T15:50:19.447","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When using the Direct XIP\nupdate strategy, the main application image starts other cores (i.e. radio\ncore), based on the currently active slot without additional verification. The\nMCUboot in the bare (upstream) configuration assumes that if there is at least\na single slot for each image available, the system is bootable and continues\nthe boot process. This may lead to a situation when MCUboot picks different\nslot for different images (i.e. (a) for the main application and (b) for the\nradio image), boots the main application (from slot (a)) that afterwards starts\nthe radio image by providing an address of the unauthenticated slot ((a)\ninstead of (b))."}],"affected":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","affectedData":[{"vendor":"Nordic Semiconductor ASA","product":"nRF54H20","defaultStatus":"unaffected","versions":[{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-08T15:00:28.845002Z","id":"CVE-2026-14296","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html","source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e"}]}},{"cve":{"id":"CVE-2026-14297","sourceIdentifier":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","published":"2026-09-07T09:17:15.430","lastModified":"2026-09-09T15:50:19.447","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record Access Control Point (RACP) write handler\n     allows an authenticated BLE peer to overflow a 20-byte static buffer into\n     adjacent BSS memory. The exploitable impact cannot be predetermined - it\n     is entirely dependent on the linker-assigned BSS layout of the specific\n     firmware build, which may vary."}],"affected":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","affectedData":[{"vendor":"Nordic Semiconductor ASA","product":"nRF Connect SDK","defaultStatus":"unaffected","versions":[{"version":"2.2.0","lessThanOrEqual":"3.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-08T15:00:48.275486Z","id":"CVE-2026-14297","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html","source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e"}]}},{"cve":{"id":"CVE-2026-18796","sourceIdentifier":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","published":"2026-09-07T09:17:15.570","lastModified":"2026-09-09T15:50:19.447","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Any application that\n     uses external QSPI flash for encrypted XIP on nRF5340 and relies on that\n     encryption for confidentiality and/or integrity of the externally stored\n     code. No specific nRF Connect SDK version is the root cause; the weakness\n     is in the on-the-fly decryption scheme."}],"affected":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","affectedData":[{"vendor":"Nordic Semiconductor ASA","product":"nRF5340","defaultStatus":"unaffected","versions":[{"version":"All build codes","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-08T15:01:20.642344Z","id":"CVE-2026-18796","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","type":"Secondary","description":[{"lang":"en","value":"CWE-1342"}]}],"references":[{"url":"https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html","source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e"}]}}]}