Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 1961–1980 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39822

io_uring/kbuf: fix signedness in this_len calculation

In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers, buf->len is considered unsigned. However, buf->len is converted to signed int when committing. This can lead to unexpected behavior if the buffer is large enough …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:21.533Z. Updated 2026-05-11T21:37:01.379Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:37 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39821

perf: Avoid undefined behavior from stopping/starting inactive events

In the Linux kernel, the following vulnerability has been resolved: perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1961 to 1980 of 4319.First page Next page

Published 2025-09-16T13:00:20.805Z. Updated 2026-08-05T12:05:25.973Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39820

drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset The drm_atomic_get_new_connector_state() can return NULL if the connector is not part of the atomic state. Add a check to prevent a NULL pointer dereference. This follows the same patte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:20.059Z. Updated 2026-05-11T21:36:59.060Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:36 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39819

fs/smb: Fix inconsistent refcnt update

In the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the functi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:19.320Z. Updated 2026-05-12T12:07:17.058Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39818

HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:18.490Z. Updated 2026-08-05T12:05:24.894Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39817

efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0x…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:17.776Z. Updated 2026-08-05T12:05:23.813Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39816

io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths

In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stabl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:17.026Z. Updated 2026-05-11T21:36:54.462Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:36 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39815

RISC-V: KVM: fix stack overrun when loading vlenb

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: fix stack overrun when loading vlenb The userspace load can put up to 2048 bits into an xlen bit stack buffer. We want only xlen bits, so check the size beforehand.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:16.250Z. Updated 2026-08-05T12:05:22.677Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39814

ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset

In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when the driver is loaded without RDMA support, will results in a crash as it attempts to remove RDMA's non-existent auxbus device: echo 1 > /sys/class/net/<if>/device…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:15.552Z. Updated 2026-05-11T21:36:52.173Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:36 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39813

ftrace: Fix potential warning in trace_printk_seq during ftrace_dump

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:14.846Z. Updated 2026-05-12T12:07:14.764Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39812

sctp: initialize more fields in sctp_v6_from_sk()

In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:14.103Z. Updated 2026-05-12T12:07:13.590Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39811

drm/xe/vm: Clear the scratch_pt pointer on error

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer. (cherry picked from commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:13.395Z. Updated 2026-05-11T21:36:48.612Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:36 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39810

bnxt_en: Fix memory corruption when FW resources change during ifdown

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:12.677Z. Updated 2026-10-21T12:37:22.794Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39809

HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and ke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:11.977Z. Updated 2026-08-05T12:05:20.529Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39808

HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()

In the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:11.242Z. Updated 2026-05-12T12:07:12.433Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:07 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39807

drm/mediatek: Add error handling for old state CRTC in atomic_disable

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL `old_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:10.408Z. Updated 2026-05-23T16:00:46.198Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:00 WIB

Official record

HighPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39806

HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:09.524Z. Updated 2026-08-05T12:05:19.463Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

UnscoredPublished 16 Sep 2025, 20:00 WIB

CVE-2025-39805

net: macb: fix unregister_netdev call order in macb_remove()

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix unregister_netdev call order in macb_remove() When removing a macb device, the driver calls phy_exit() before unregister_netdev(). This leads to a WARN from kernfs: ------------[ cut here ]------------ kernfs: can not remove 'atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T13:00:06.731Z. Updated 2026-05-11T21:36:36.596Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:36 WIB

Official record

MedPublished 16 Sep 2025, 19:49 WIB

CVE-2025-7355

IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T12:49:41.870Z. Updated 2026-06-05T13:47:35.879Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 20:47 WIB

Official record

UnscoredPublished 16 Sep 2025, 19:26 WIB

CVE-2025-10290

Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-16T12:26:39.308Z. Updated 2026-04-13T14:29:50.967Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:29 WIB

Official record