Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates
6,933 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.
Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS
IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:16:21.010Z. Updated 2026-05-27T15:30:41.605Z.
Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.
Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:14:23.238Z. Updated 2026-05-28T13:26:42.977Z.
Open BMC Denial of Service
IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:12:06.648Z. Updated 2026-05-27T14:48:48.502Z.
IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query
IBM Db2 12.1.0 through 12.1.4 is vulnerable to authorization bypass when uploading to a remote object storage path with a special query.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:11:31.279Z. Updated 2026-05-27T14:45:33.154Z.
IBM i is Affected by a Denial of Service Vulnerability []
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a denial-of-service attack due to uncontrolled recursion in the Integrated Language Environment (ILE) compiler. An authenticated attacker could exploit this vulnerability by compiling specially crafted source code containing a specific combination of statements.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:10:46.314Z. Updated 2026-05-27T15:30:14.915Z.
IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables.
Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:10:05.402Z. Updated 2026-05-29T15:32:13.728Z.
IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to running out of memory when executing certain queries with MDC tables.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:09:29.770Z. Updated 2026-05-27T15:22:19.791Z.
IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service when executing a specially crafted query with a small statement heap.
Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:07:47.761Z. Updated 2026-05-27T14:41:58.407Z.
IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability
IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.
Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T13:00:04.029Z. Updated 2026-06-02T16:13:02.756Z.
can: ucan: fix devres lifetime
In the Linux kernel, the following vulnerability has been resolved: can: ucan: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when drivers are unbound without t…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:59:11.533Z. Updated 2026-06-19T11:59:29.306Z.
net: strparser: fix skb_head leak in strp_abort_strp()
In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skb_head leak in strp_abort_strp() When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp->skb_head. That skb is not released in str…
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:59:09.526Z. Updated 2026-10-19T19:26:43.592Z.
netfilter: reject zero shift in nft_bitwise
In the Linux kernel, the following vulnerability has been resolved: netfilter: reject zero shift in nft_bitwise Reject zero shift operands for nft_bitwise left and right shift expressions during initialization. The carry propagation logic computes the carry from the adjacent 32-bit word using BITS_PER_TYPE(u32) - sh…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:59:08.220Z. Updated 2026-10-15T01:20:30.172Z.
fs: afs: revert mmap_prepare() change
In the Linux kernel, the following vulnerability has been resolved: fs: afs: revert mmap_prepare() change Partially reverts commit 9d5403b1036c ("fs: convert most other generic_file_*mmap() users to .mmap_prepare()"). This is because the .mmap invocation establishes a refcount, but .mmap_prepare is called at a point…
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:59:06.853Z. Updated 2026-08-05T12:29:37.582Z.
net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() unconditionally. On PREEMPT_RT, ksoftirqd is pr…
Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:59:04.628Z. Updated 2026-10-19T19:26:43.421Z.
net: caif: clear client service pointer on teardown
In the Linux kernel, the following vulnerability has been resolved: net: caif: clear client service pointer on teardown `caif_connect()` can tear down an existing client after remote shutdown by calling `caif_disconnect_client()` followed by `caif_free_client()`. `caif_free_client()` releases the service layer refere…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:59:02.308Z. Updated 2026-06-14T17:54:16.006Z.
Input: edt-ft5x06 - fix use-after-free in debugfs teardown
In the Linux kernel, the following vulnerability has been resolved: Input: edt-ft5x06 - fix use-after-free in debugfs teardown The commit 68743c500c6e ("Input: edt-ft5x06 - use per-client debugfs directory") removed the manual debugfs teardown, relying on the I2C core to handle it. However, this creates a window wher…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:58:59.100Z. Updated 2026-06-14T17:54:10.915Z.
tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm2_read_public() calls tpm_buf_init() but fails to call tpm_buf_destroy() on two exit paths, leaking a page allocation: 1. When name_size() returns an error (unrecognized hash algo…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:58:56.233Z. Updated 2026-06-14T17:54:06.722Z.
md/md-llbitmap: raise barrier before state machine transition
In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: raise barrier before state machine transition Move the barrier raise operation before calling llbitmap_state_machine() in both llbitmap_start_write() and llbitmap_start_discard(). This ensures the barrier is in place before any state …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:58:48.179Z. Updated 2026-06-14T17:54:02.473Z.
ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access The bounds check for the next xattr entry in check_xattrs() uses (void *)next >= end, which allows next to point within sizeof(u32) bytes of end. On the next loop iteration, IS_…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:58:45.304Z. Updated 2026-06-14T17:53:57.266Z.
mm/vmalloc: take vmap_purge_lock in shrinker
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: take vmap_purge_lock in shrinker decay_va_pool_node() can be invoked concurrently from two paths: __purge_vmap_area_lazy() when pools are being purged, and the shrinker via vmap_node_shrink_scan(). However, decay_va_pool_node() is not sa…
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-05-27T12:58:43.458Z. Updated 2026-08-05T12:29:35.424Z.