CVE-2026-19291

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
silabs.comWiseConnect>= 4.0.0, < 4.1.0; >= 2.0.0, < 2.14.0

References

Timeline

Published
Aug 13, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-192928.8Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paCVE-2026-192938.8SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keCVE-2026-192946.5IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to impropeCVE-2026-192959.9IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process CVE-2026-192979.1IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restrictioCVE-2026-192988.8IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass iCVE-2026-192996.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.CVE-2026-19304.3The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_CVE-2026-193007.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitiveCVE-2026-193016.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side requestCVE-2026-193026.5IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validationCVE-2026-193038.1IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to impr