Caliptra Project
First CVE: Jun 24, 2026Active for: 1 year
3
CVEs Published
More CVEs Published than 9% of tracked CNAs
3.0
Avg CVEs / Year
More Avg CVEs / Year than 19% of tracked CNAs
6.4
Avg CVSS Score
Higher Avg CVSS Score than 20% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Trends Over Time
The number and severity of CVEs published by Caliptra Project over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 24, 2026
30 days ago
Most Recent CVE
Jul 22, 2026
2 days ago
Top CVEs
All CVEs published by Caliptra Project as a CNA, regardless of affected vendor or product.
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-7328MEDIUM Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local atta | Jul 22, 2026 | 6.8 | 30 | NO | NO |
CVE-2026-5818HIGH Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Core's verification of the MCU FW du | Jun 24, 2026 | 7.2 | 29 | NO | NO |
CVE-2026-6458MEDIUM Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag. When the streaming AES-256-GCM API is used with emp | Jun 24, 2026 | 5.1 | 24 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA3 CVEs
67%
33%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (33.3%)
Network0 (0.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low2 (66.7%)
High1 (33.3%)
None0 (0.0%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (3 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by Caliptra Project as a CNA.
Media Mentions
Media articles that mention a CVE ID published by Caliptra Project as a CNA — matched by CVE ID, not by organization name.