CVE Program partner

Caliptra

Caliptra Project

API
CVEs, 365 days55 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationCaliptra Project
RoleCNA
TypeOpen Source
Reports tomitre
ScopeCaliptra Project components and vulnerabilities that are not in another CNA’s scope.
Advisorieshttps://github.com/chipsalliance/Caliptra/security/advisories

Latest CVEs · RSS

  • CVE-2026-11835 2026-08-04 · CVSS 5.6
    Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a
  • CVE-2026-11836 2026-08-04 · CVSS 1.8
    Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with
  • CVE-2026-7328 2026-07-22 · CVSS 6.8
    Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a p
  • CVE-2026-5818 2026-06-23 · CVSS 7.2
    Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Core's verificat
  • CVE-2026-6458 2026-06-23 · CVSS 5.1
    Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM

All CVE Program partners