Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1521–1540 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23307

can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message

In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not the transfer_buffer_length which is set by the driver as the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:02.746Z. Updated 2026-05-11T22:04:21.150Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23306

scsi: pm8001: Fix use-after-free in pm8001_queue_command()

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the funct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1521 to 1540 of 6236.First page Next page

Published 2026-03-25T10:27:01.719Z. Updated 2026-08-05T12:21:11.431Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23305

accel/rocket: fix unwinding in error path in rocket_probe

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (as could be the case with EPROBE_DEFER), we need to properly unwind by decrementing the counter we just incremented and if this is the first core we failed to pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:00.612Z. Updated 2026-05-11T22:04:18.823Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23304

ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost the fallback to loopback in ip6_rt_pcpu_alloc() -> ip6_rt_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:59.015Z. Updated 2026-10-15T01:13:54.349Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23303

smb: client: Don't log plaintext credentials in cifs_set_cifscreds

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifs_set_cifscreds When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing credentials.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:58.166Z. Updated 2026-10-15T01:13:52.569Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23302

net: annotate data-races around sk->sk_{data_ready,write_space}

In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:57.470Z. Updated 2026-10-15T01:13:51.391Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23301

ASoC: SDCA: Add allocation failure check for Entity name

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently find_sdca_entity_iot() can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the missing NULL check after the allocation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:56.830Z. Updated 2026-05-11T22:04:14.186Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23300

net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_nh_init() misclassifies it as a reject route. This is becaus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:56.138Z. Updated 2026-10-15T01:13:50.190Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23299

Bluetooth: purge error queues in socket destructors

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: purge error queues in socket destructors When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued into sk_error_queue and will stay there until consumed. If userspace never gets to read the timestamps, or if the controller i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:55.481Z. Updated 2026-05-11T22:04:11.865Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23298

can: ucan: Fix infinite loop from zero-length messages

In the Linux kernel, the following vulnerability has been resolved: can: ucan: Fix infinite loop from zero-length messages If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just sk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:54.830Z. Updated 2026-05-11T22:04:10.668Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23297

nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is not called after that. The cred is finally passed down to _…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:54.156Z. Updated 2026-05-11T22:04:09.525Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23296

scsi: core: Fix refcount leak for tagset_refcnt

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix refcount leak for tagset_refcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:53.509Z. Updated 2026-10-15T01:13:48.273Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23295

accel/amdxdna: Fix dead lock for suspend and resume

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix dead lock for suspend and resume When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls pm_runtime_resume_and_get(), which waits for the ongoing su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:52.789Z. Updated 2026-10-15T10:06:56.177Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:06 WIB

Official record

HighPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23294

bpf: Fix race in devmap on PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in devmap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __dev_flush() run atomically with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:51.946Z. Updated 2026-08-05T12:21:10.341Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23293

net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If an IPv6 packet is inject…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:51.160Z. Updated 2026-10-15T01:13:47.078Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23292

scsi: target: Fix recursive locking in __configfs_open_file()

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_dbroot_store(). This function called filp_open(), following …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:50.408Z. Updated 2026-10-15T01:13:45.389Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23291

nfc: pn533: properly drop the usb interface reference on disconnect

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbed in the probe callback. Fix this up by properly dropping …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:49.634Z. Updated 2026-10-15T01:13:44.177Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23290

net: usb: pegasus: validate USB endpoints

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not have the same urbs t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:48.886Z. Updated 2026-10-15T01:13:42.962Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:13 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23289

IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix a user triggerable leak on the system call failure path.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:48.207Z. Updated 2026-05-11T22:03:59.470Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:03 WIB

Official record

HighPublished 25 Mar 2026, 17:26 WIB

CVE-2026-23288

accel/amdxdna: Fix out-of-bounds memset in command slot handling

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with memset() before verifying the available slot space can result …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:26:47.458Z. Updated 2026-08-05T12:21:09.253Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record