https://vulnogram.org/ Most recent CVEs assigned by Caliptra Project (caliptra). https://vulnogram.org/seaview/icons/caliptra.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2026-11835 https://vulnogram.org/CVE-2026-11835 Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging add… Medium Tue, 04 Aug 2026 00:03:23 GMT https://vulnogram.org/CVE-2026-11836 https://vulnogram.org/CVE-2026-11836 Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an u… Low Tue, 04 Aug 2026 00:02:34 GMT https://vulnogram.org/CVE-2026-7328 https://vulnogram.org/CVE-2026-7328 Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unve… Medium Wed, 22 Jul 2026 16:17:27 GMT https://vulnogram.org/CVE-2026-5818 https://vulnogram.org/CVE-2026-5818 Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Core's verification of the MCU FW during a hitless update. This issue affects Core Runtime Firmware: from… High Tue, 23 Jun 2026 23:50:06 GMT https://vulnogram.org/CVE-2026-6458 https://vulnogram.org/CVE-2026-6458 Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with empty AAD, the hardware GHASH accumulator state is not saved after the fi… Medium Tue, 23 Jun 2026 23:49:44 GMT