Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 1501–1520 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

HighPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49956

staging: rtl8712: fix use after free bugs

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix use after free bugs _Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() functions don't do anything except free the "pcmd" pointer. It results in a use after free. Delete them.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:18.341Z. Updated 2026-08-05T08:56:53.613Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 15:56 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49955

powerpc/rtas: Fix RTAS MSR[HV] handling for Cell

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Fix RTAS MSR[HV] handling for Cell The semi-recent changes to MSR handling when entering RTAS (firmware) cause crashes on IBM Cell machines. An example trace: kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0) …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1501 to 1520 of 3682.First page Next page

Published 2025-06-18T11:00:17.617Z. Updated 2026-05-23T15:23:21.973Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:23 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49954

Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag syzbot is reporting hung task at __input_unregister_device() [1], for iforce_close() waiting at wait_event_interruptible() with dev->mutex held is blocking input_disconnect_device() from…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:16.928Z. Updated 2026-05-11T19:09:53.509Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49953

iio: light: cm3605: Fix an error handling path in cm3605_probe()

In the Linux kernel, the following vulnerability has been resolved: iio: light: cm3605: Fix an error handling path in cm3605_probe() The commit in Fixes also introduced a new error handling path which should goto the existing error handling path. Otherwise some resources leak.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:16.249Z. Updated 2026-05-11T19:09:52.300Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

HighPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49952

misc: fastrpc: fix memory corruption on probe

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on probe Add the missing sanity check on the probed-session count to avoid corrupting memory beyond the fixed-size slab-allocated session array when there are more than FASTRPC_MAX_SESSIONS sessions defined in the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:15.434Z. Updated 2026-08-05T08:56:52.538Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 15:56 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49951

firmware_loader: Fix use-after-free during unregister

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix use-after-free during unregister In the following code within firmware_upload_unregister(), the call to device_unregister() could result in the dev_release function freeing the fw_upload_priv structure before it is dereferenced f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:14.694Z. Updated 2026-05-11T19:09:49.839Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

HighPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49950

misc: fastrpc: fix memory corruption on open

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on open The probe session-duplication overflow check incremented the session count also when there were no more available sessions so that memory beyond the fixed-size slab-allocated session array could be corrupt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:13.985Z. Updated 2026-08-05T08:56:51.450Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 15:56 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49949

firmware_loader: Fix memory leak in firmware upload

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix memory leak in firmware upload In the case of firmware-upload, an instance of struct fw_upload is allocated in firmware_upload_register(). This data needs to be freed in fw_dev_release(). Create a new fw_upload_free() function in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:13.277Z. Updated 2026-05-11T19:09:47.562Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

HighPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49948

vt: Clear selection before changing the font

In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bound…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:12.364Z. Updated 2026-10-15T21:31:17.598Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:31 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49947

binder: fix alloc->vma_vm_mm null-ptr dereference

In the Linux kernel, the following vulnerability has been resolved: binder: fix alloc->vma_vm_mm null-ptr dereference Syzbot reported a couple issues introduced by commit 44e602b4e52f ("binder_alloc: add missing mmap_lock calls when using the VMA"), in which we attempt to acquire the mmap_lock when alloc->vma_vm_mm h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:11.012Z. Updated 2026-05-11T19:09:45.277Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49946

clk: bcm: rpi: Prevent out-of-bounds access

In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Prevent out-of-bounds access The while loop in raspberrypi_discover_clocks() relies on the assumption that the id of the last clock element is zero. Because this data comes from the Videocore firmware and it doesn't guarantuee such a b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:07.966Z. Updated 2026-05-11T19:09:44.094Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

UnscoredPublished 18 Jun 2025, 18:00 WIB

CVE-2022-49945

hwmon: (gpio-fan) Fix array out of bounds access

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T11:00:01.037Z. Updated 2026-05-11T19:09:42.968Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

HighPublished 18 Jun 2025, 17:59 WIB

CVE-2022-49944

Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" The recent commit 87d0e2f41b8c ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()") introduced a regression that caused NULL dereference at reading the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:59:59.319Z. Updated 2026-08-05T08:56:49.285Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 15:56 WIB

Official record

UnscoredPublished 18 Jun 2025, 17:59 WIB

CVE-2022-49943

USB: gadget: Fix obscure lockdep violation for udc_mutex

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udc_mutex A recent commit expanding the scope of the udc_lock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form: =========================…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:59:58.516Z. Updated 2026-05-11T19:09:40.620Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

UnscoredPublished 18 Jun 2025, 17:59 WIB

CVE-2022-49942

wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:59:57.610Z. Updated 2026-05-11T19:09:39.486Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

UnscoredPublished 18 Jun 2025, 17:54 WIB

CVE-2022-49940

tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() A null pointer dereference can happen when attempting to access the "gsm->receive()" function in gsmld_receive_buf(). Currently, the code assumes that gsm->recieve is only called afte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:54:40.745Z. Updated 2026-05-23T15:23:19.793Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:23 WIB

Official record

HighPublished 18 Jun 2025, 17:54 WIB

CVE-2022-49939

binder: fix UAF of ref->proc caused by race condition

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of ref->proc caused by race condition A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:54:40.100Z. Updated 2026-08-05T08:56:48.206Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 15:56 WIB

Official record

UnscoredPublished 18 Jun 2025, 17:54 WIB

CVE-2022-49938

cifs: fix small mempool leak in SMB2_negotiate()

In the Linux kernel, the following vulnerability has been resolved: cifs: fix small mempool leak in SMB2_negotiate() In some cases of failure (dialect mismatches) in SMB2_negotiate(), after the request is sent, the checks would return -EIO when they should be rather setting rc = -EIO and jumping to neg_exit to free t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:54:39.458Z. Updated 2026-05-23T15:23:18.671Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:23 WIB

Official record

UnscoredPublished 18 Jun 2025, 17:54 WIB

CVE-2022-49937

media: mceusb: Use new usb_control_msg_*() routines

In the Linux kernel, the following vulnerability has been resolved: media: mceusb: Use new usb_control_msg_*() routines Automatic kernel fuzzing led to a WARN about invalid pipe direction in the mceusb driver: ------------[ cut here ]------------ usb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 4…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:54:38.812Z. Updated 2026-05-11T19:09:34.854Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record

UnscoredPublished 18 Jun 2025, 17:54 WIB

CVE-2022-49936

USB: core: Prevent nested device-reset calls

In the Linux kernel, the following vulnerability has been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: ============================================ WARNING: possible recursive locking detected 5.18.0 #3 Not tainted ------------…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-18T10:54:37.889Z. Updated 2026-05-11T19:09:33.668Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:09 WIB

Official record