Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 1421–1440 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 22 Apr 2026, 21:00 WIB

CVE-2026-33608

Incomplete domain name sanitization during

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to an invalid one, leading to the backend no longer able to run on the next restart, requiring manual operation to fix it.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T14:00:15.473Z. Updated 2026-04-22T14:28:15.172Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 21:28 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31530

cxl/port: Fix use after free of parent_port in cxl_detach_ep()

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its paren…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1421 to 1440 of 5813.First page Next page

Published 2026-04-22T13:54:42.563Z. Updated 2026-10-21T12:39:25.498Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:39 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31529

cxl/region: Fix leakage in __construct_region()

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix leakage in __construct_region() Failing the first sysfs_update_group() needs to explicitly kfree the resource as it is too early for cxl_region_iomem_release() to do so.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:41.853Z. Updated 2026-05-11T22:10:33.610Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:10 WIB

Official record

HighPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31528

perf: Make sure to use pmu_ctx->pmu for groups

In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This *should* be handled by the transaction callbacks, but he found th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:41.180Z. Updated 2026-10-19T18:45:55.081Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:45 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31527

driver core: platform: use generic driver_override infrastructure

In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:40.485Z. Updated 2026-06-01T16:11:39.964Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jun 2026, 23:11 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31526

bpf: Fix exception exit lock checking for subprogs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix exception exit lock checking for subprogs process_bpf_exit_full() passes check_lock = !curframe to check_resource_leak(), which is false in cases when bpf_throw() is called from a static subprog. This makes check_resource_leak() to skip vali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:39.800Z. Updated 2026-10-21T12:39:24.405Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:39 WIB

Official record

HighPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31525

bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:39.144Z. Updated 2026-10-19T18:45:54.927Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:45 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31524

HID: asus: avoid memory leak in asus_report_fixup()

In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:38.389Z. Updated 2026-05-11T22:10:27.784Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:10 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31523

nvme-pci: ensure we're polling a polled queue

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would rac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:37.568Z. Updated 2026-05-11T22:10:26.646Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:10 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31522

HID: magicmouse: avoid memory leak in magicmouse_report_fixup()

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: avoid memory leak in magicmouse_report_fixup() The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned point…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:36.885Z. Updated 2026-05-23T16:05:16.510Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:05 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31521

module: Fix kernel panic when a symbol st_shndx is out of bounds

In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { const char *name = info->s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:36.211Z. Updated 2026-10-15T01:16:53.401Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:16 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31520

HID: apple: avoid memory leak in apple_report_fixup()

In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoid memory leak in apple_report_fixup() The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is*…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:35.534Z. Updated 2026-05-11T22:10:23.085Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:10 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31519

btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create

In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Jan 23 16:49 . drwxr-xr-x 1 root root 24 Jan 23 16:48 .. d??…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:34.860Z. Updated 2026-05-23T16:05:15.433Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:05 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31518

esp: fix skb leak with espintcp and async crypto

In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us. With as…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:34.191Z. Updated 2026-10-15T01:16:51.564Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:16 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31517

xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly In iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner packet 'newskb' that is being reassembled. First a zero-copy approach is tried if it succeeds then newskb be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:33.522Z. Updated 2026-05-11T22:10:19.646Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:10 WIB

Official record

HighPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31516

xfrm: prevent policy_hthresh.work from racing with netns teardown

In the Linux kernel, the following vulnerability has been resolved: xfrm: prevent policy_hthresh.work from racing with netns teardown A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callback, xfrm_hash_rebuild(), retrieves the enclosing struct n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:32.851Z. Updated 2026-10-19T18:45:54.791Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:45 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31515

af_key: validate families in pfkey_send_migrate()

In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:32.194Z. Updated 2026-10-15T01:16:49.668Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:16 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31514

erofs: set fileio bio failed in short read case

In the Linux kernel, the following vulnerability has been resolved: erofs: set fileio bio failed in short read case For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of bytes actually copied. Unused folios in bio are unexpectedly ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:31.531Z. Updated 2026-10-23T08:20:15.576Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 15:20 WIB

Official record

HighPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31513

Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit Based Connection Request. The vulnerability stems from l2ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:30.835Z. Updated 2026-10-19T18:45:54.652Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:45 WIB

Official record

UnscoredPublished 22 Apr 2026, 20:54 WIB

CVE-2026-31512

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-22T13:54:30.171Z. Updated 2026-05-11T22:10:13.614Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:10 WIB

Official record