Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1501–1520 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23328

accel/amdxdna: Fix NULL pointer dereference of mgmt_chann

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop(). Fix this by introd…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:20.559Z. Updated 2026-10-15T10:06:57.247Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:06 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23327

cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying its size. When a raw mailbox command is sent with an undersi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1501 to 1520 of 6236.First page Next page

Published 2026-03-25T10:27:19.815Z. Updated 2026-10-21T12:39:06.010Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:39 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23326

xsk: Fix fragment node deletion to prevent buffer leak

In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as descri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:19.021Z. Updated 2026-05-11T22:04:42.016Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23325

wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oob access.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:18.204Z. Updated 2026-05-11T22:04:40.848Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23324

can: usb: etas_es58x: correctly anchor the urb in the read bulk callback

In the Linux kernel, the following vulnerability has been resolved: can: usb: etas_es58x: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:17.476Z. Updated 2026-05-11T22:04:39.706Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23323

hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver

In the Linux kernel, the following vulnerability has been resolved: hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver The recently added macsmc-hwmon driver contained several critical bugs in its sensor population logic and float conversion routines. Specifically: - The voltage sensor population loop…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:16.697Z. Updated 2026-05-11T22:04:38.583Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23322

ipmi: Fix use-after-free and list corruption on sender error

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to restart without cleaning up properly: 1. intf->curr_msg is not …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:15.954Z. Updated 2026-05-11T22:04:37.458Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23321

mptcp: pm: in-kernel: always mark signal+subflow endp as used

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mptcp/pm_kernel.c:1071 at __mark_subflow_endp_available …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:15.125Z. Updated 2026-10-15T01:14:04.247Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23319

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is considered released but may still be referenced via 'tr->progs_hlis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:13.678Z. Updated 2026-10-15T01:14:02.294Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23318

ALSA: usb-audio: Use correct version for UAC3 header validation

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:12.884Z. Updated 2026-10-15T01:14:00.531Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23317

drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:11.884Z. Updated 2026-10-19T18:35:41.612Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23316

net: ipv4: fix ARM64 alignment fault in multipath hash seed

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed `struct sysctl_fib_multipath_hash_seed` contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byte alignment requirement. In `fib_multipath_hash_from_keys(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:11.028Z. Updated 2026-05-11T22:04:31.681Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23315

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access. [fix check to also cover mgmt->u.action.u.ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:10.115Z. Updated 2026-10-15T01:13:58.125Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23314

regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()

In the Linux kernel, the following vulnerability has been resolved: regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() In bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns without calling of_node_put(child), causing the device node reference leak.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:09.383Z. Updated 2026-05-11T22:04:29.413Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23313

i40e: Fix preempt count leak in napi poll tracepoint

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix preempt count leak in napi poll tracepoint Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:08.686Z. Updated 2026-05-11T22:04:28.296Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23312

net: usb: kaweth: validate USB endpoints

In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:07.916Z. Updated 2026-10-15T01:13:56.754Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23311

perf/core: Fix invalid wait context in ctx_sched_in()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix invalid wait context in ctx_sched_in() Lockdep found a bug in the event scheduling when a pinned event was failed and wakes up the threads in the ring buffer like below. It seems it should not grab a wait-queue lock under perf-context…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:06.915Z. Updated 2026-05-11T22:04:25.774Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23310

bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded

In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_check(). However, bond_option_xmit_hash_policy_set() has no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:05.943Z. Updated 2026-10-15T01:13:55.557Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23309

tracing: Add NULL pointer check to trigger_data_free()

In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handles a NULL pointer, trigger_data_free() does not. This causes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:04.828Z. Updated 2026-05-11T22:04:23.455Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23308

pinctrl: equilibrium: fix warning trace on load

In the Linux kernel, the following vulnerability has been resolved: pinctrl: equilibrium: fix warning trace on load The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also called in the callback function 'eqbr_irq_mask_ack()'. This is done to avoid source code duplication. The problem, is that in the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:03.536Z. Updated 2026-05-11T22:04:22.327Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record