Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1461–1480 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23369

i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. Under rare circumstances, multiple udev threads can collect i801 device info on boot and walk i801_acpi_io_handler somew…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:50.705Z. Updated 2026-05-11T22:05:32.733Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23368

net: phy: register phy led_triggers during probe to avoid AB-BA deadlock

In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [<8054e4b8>] led_trigger_register+0x5c/0x1fc <-- Trying to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1461 to 1480 of 6236.First page Next page

Published 2026-03-25T10:27:49.889Z. Updated 2026-10-15T01:14:27.887Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23367

wifi: radiotap: reject radiotap with unknown bits

In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterato…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:49.068Z. Updated 2026-10-15T01:14:25.958Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23366

drm/client: Do not destroy NULL modes

In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_probe may fail to kcalloc. If this occurs, we jump to 'out', calling modes_destroy on it, which dereferences it. This may result in a NULL pointer dereference in the error case. P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:48.311Z. Updated 2026-05-11T22:05:28.991Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23365

net: usb: kalmia: validate USB endpoints

In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: validate USB endpoints The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:47.609Z. Updated 2026-10-15T01:14:24.758Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23364

ksmbd: Compare MACs in constant time

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq().

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:46.960Z. Updated 2026-10-15T01:14:22.928Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23363

wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:46.204Z. Updated 2026-05-11T22:05:25.399Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23362

can: bcm: fix locking for bcm_op runtime updates

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime when updating the sending bcm_op with a new TX_SETUP command …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:45.476Z. Updated 2026-05-23T16:04:37.669Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23361

PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for poste…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:44.750Z. Updated 2026-10-21T12:39:07.282Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:39 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23360

nvme: fix admin queue leak on controller reset

In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:43.892Z. Updated 2026-05-23T16:04:36.667Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23359

bpf: Fix stack-out-of-bounds write in devmap

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and alloc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:43.070Z. Updated 2026-10-15T01:14:21.697Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23358

drm/amdgpu: Fix error handling in slot reset

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot reset is called, it goes to out label for error handling. There it could make decision based on uninitialized hive pointer and could result in accessing an uninit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:42.327Z. Updated 2026-05-11T22:05:19.301Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23357

can: mcp251x: fix deadlock in error path of mcp251x_open

In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:41.299Z. Updated 2026-10-15T01:14:19.571Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23356

drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()

In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:40.454Z. Updated 2026-10-15T01:14:18.241Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23355

ata: libata: cancel pending work after clearing deferred_qc

In the Linux kernel, the following vulnerability has been resolved: ata: libata: cancel pending work after clearing deferred_qc Syzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by ap->ops->qc_defer() returning non-zero before issuing the deferred qc. ata_scsi_schedule_deferred_qc() is called during…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:39.514Z. Updated 2026-05-26T16:17:50.796Z.

CVSS—KEVNot listedEPSSPresentUpdated26 May 2026, 23:17 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23354

x86/fred: Correct speculative safety in fred_extint()

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:38.825Z. Updated 2026-05-11T22:05:14.621Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23353

ice: fix crash in ethtool offline loopback test

In the Linux kernel, the following vulnerability has been resolved: ice: fix crash in ethtool offline loopback test Since the conversion of ice to page pool, the ethtool loopback test crashes: BUG: kernel NULL pointer dereference, address: 000000000000000c #PF: supervisor write access in kernel mode #PF: error_co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:38.167Z. Updated 2026-10-26T15:12:55.677Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:12 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23352

x86/efi: defer freeing of boot services memory

In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two issue with that: memblock_free_late() should be used for mem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:37.500Z. Updated 2026-10-15T01:14:17.020Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23351

netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, trigg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:36.854Z. Updated 2026-10-19T18:35:42.025Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23350

drm/xe/queue: Call fini on exec queue creation fail

In the Linux kernel, the following vulnerability has been resolved: drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list (which is part of guc_id allocation). A damaged queue stored in e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:36.182Z. Updated 2026-08-05T12:21:15.714Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record