Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1581–1600 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80573

Input: iforce - validate input packet lengths

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally reads data[6]. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:33.756Z. Updated 2026-08-27T04:58:55.441Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 11:58 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80572

Input: byd - synchronize timer deletion before freeing private data

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1581 to 1600 of 12259.First page Next page

Published 2026-08-26T14:37:33.141Z. Updated 2026-10-16T19:26:27.388Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80571

powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_create_handle(), the params->cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is either 0 or exce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:32.541Z. Updated 2026-08-26T14:37:32.541Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:37 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80570

Input: synaptics-rmi4 - zero report size on F54 work error

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was norm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:31.940Z. Updated 2026-08-27T05:01:54.209Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80569

Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get_report_size(): report_size = rmi_f54_get_report_size(f54…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:31.338Z. Updated 2026-08-27T05:01:53.135Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80568

Input: synaptics-rmi4 - block s_input when F54 queue is busy

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:30.740Z. Updated 2026-08-27T05:01:52.050Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80567

Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmi_f54_buffer_queue() waited for the worker thread to finish but ignored whether it succeeded. If the worker failed (e.g., due to a timeout or register read failure), the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:30.152Z. Updated 2026-08-26T14:37:30.152Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:37 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80566

Input: hynitron_cstxxx - validate touch count and finger IDs

In the Linux kernel, the following vulnerability has been resolved: Input: hynitron_cstxxx - validate touch count and finger IDs The driver allocates max_touch_num input slots, which are indexed from zero through max_touch_num - 1. The current check allows a finger ID equal to max_touch_num to reach cst3xx_report_con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:29.552Z. Updated 2026-08-26T14:37:29.552Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:37 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80565

crypto: qce - fix error path in devm_qce_register_algs

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:28.953Z. Updated 2026-08-27T05:01:50.972Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80564

gve: fix NULL dereference due to missing ptp adjfine

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 [ 551.943697] BUG: kernel NULL pointer dereference…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:28.351Z. Updated 2026-08-26T14:37:28.351Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:37 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80563

gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigger" debugfs file has a hand-rolled ->write handler (trigger_write()) that dereferences the per-device gpio_la_poll_priv. The file is created with debugfs_create_f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:27.759Z. Updated 2026-08-26T14:37:27.759Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2026, 21:37 WIB

Official record

UnscoredPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80562

gpio: ml-ioh: use raw_spinlock_t for the register lock

In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_t for the register lock ioh_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is reached from __setup_irq() -> __irq_set_trigger() -> chip-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:27.171Z. Updated 2026-08-27T12:40:17.967Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:40 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80561

libceph: fix multiple unsafe decodes in decode_locker()

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:26.572Z. Updated 2026-10-16T19:26:27.238Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80560

openrisc: signal: do not restore privileged SR bits on sigreturn

In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe)…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:25.971Z. Updated 2026-08-27T05:01:48.838Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80559

Input: sur40 - fix input device registration ordering

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:25.371Z. Updated 2026-08-27T05:01:47.768Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80558

libceph: Avoid using invalid osd indices from primary_temp

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:24.768Z. Updated 2026-10-16T19:26:27.095Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80557

libceph: fix OOB read in decode_watchers() via missing bounds check

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:24.178Z. Updated 2026-10-16T19:26:26.946Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80556

mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq. If we rem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:23.573Z. Updated 2026-08-27T05:01:44.585Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 12:01 WIB

Official record

HighPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80555

s390/vfio_ccw: Free all memory if cp_init() fails

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:22.969Z. Updated 2026-08-27T12:40:15.211Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:40 WIB

Official record

CritPublished 26 Aug 2026, 21:37 WIB

CVE-2026-80554

s390/vfio_ccw: Limit the number of channel program segments

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a sing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-26T14:37:22.376Z. Updated 2026-10-16T19:26:26.790Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:26 WIB

Official record