Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1561–1580 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 26 Aug 2026, 22:30 WIB

CVE-2026-54614

DebugKit: MailPreview contains unsafe reflection

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:30:23.966Z. Updated 2026-08-29T02:40:09.901Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:40 WIB

Official record

CritPublished 26 Aug 2026, 22:28 WIB

CVE-2026-54569

SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1561 to 1580 of 12259.First page Next page

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:28:19.919Z. Updated 2026-08-26T17:35:57.088Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:35 WIB

Official record

HighPublished 26 Aug 2026, 22:25 WIB

CVE-2026-54606

SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script element follows a valid ifra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T15:25:58.083Z. Updated 2026-08-26T18:28:06.384Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 01:28 WIB

Official record

CritPublished 26 Aug 2026, 21:50 WIB

CVE-2026-75062

Eval Injection in google/langfun via default lf.query protocol

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:50:50.604Z. Updated 2026-08-27T16:55:00.832Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:55 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80589

block: stop the timeout timer when releasing a never added disk

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:43.293Z. Updated 2026-10-16T19:26:29.099Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80588

mptcp: reclaim forward-allocated memory on RX path errors

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:42.685Z. Updated 2026-10-16T19:26:28.920Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80587

mptcp: avoid combining some incoming suboptions

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:42.093Z. Updated 2026-10-16T19:26:28.773Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80586

mptcp: options: reset DSS fields in case of unexpected size

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:41.493Z. Updated 2026-10-16T19:26:28.632Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80585

mptcp: fastopen: only mark MPTFO subflows with SYN data

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_param…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:40.901Z. Updated 2026-10-16T19:26:28.485Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80584

s390/qeth: validate user buffer length in SNMP and ARP query ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking a lower bound, then set udata_offset to a fixed non-zero va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:40.302Z. Updated 2026-10-16T19:26:28.329Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80583

ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:39.704Z. Updated 2026-08-27T12:40:21.902Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:40 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80582

drm/shmem_helper: Check VMA boundaries for PMD mappings

In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other ->huge_fault handlers have similar checks and the resulting mapp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:39.113Z. Updated 2026-08-27T05:02:02.758Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:02 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80581

ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out. If the firmware has crashed the kernel still needs to go through the sta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:38.510Z. Updated 2026-10-21T12:46:31.655Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80580

fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:37.917Z. Updated 2026-10-16T19:26:28.187Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80579

fbdev: clear fb_info->mode before deleting a videomode

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:37.320Z. Updated 2026-10-16T19:26:28.024Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80578

fbdev: core: Fix pointer desynchronization in fb_io_read()

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the hardware 's…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:36.722Z. Updated 2026-10-16T19:26:27.851Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80577

drm/panthor: skip zero-sized firmware sections

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthor_fw_load_section_entry() skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section->mem is left as NULL. Later reload and unp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:36.132Z. Updated 2026-08-26T14:37:36.132Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:37 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80576

drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:35.538Z. Updated 2026-10-21T12:46:30.539Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80575

Input: cs40l50-vibra - validate custom data from user space

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect straight from the ff_effect the user passed to EVIOCSFF, without requiring it to hold anything: work_data.custom_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:34.942Z. Updated 2026-08-27T05:01:57.416Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80574

Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:34.353Z. Updated 2026-10-16T19:26:27.544Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record