Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1121–1140 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 27 May 2026, 19:58 WIB

CVE-2026-46073

hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt

In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt wait_for_completion_interruptible_timeout() returns -ERESTARTSYS when interrupted. This needs to abort the URB and return an error. No data has been received from the device so any reads …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:58:01.478Z. Updated 2026-06-14T17:52:19.817Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:52 WIB

Official record

UnscoredPublished 27 May 2026, 19:58 WIB

CVE-2026-46072

ntfs3: add buffer boundary checks to run_unpack()

In the Linux kernel, the following vulnerability has been resolved: ntfs3: add buffer boundary checks to run_unpack() run_unpack() checks `run_buf < run_last` at the top of the while loop but then reads size_size and offset_size bytes via run_unpack_s64() without verifying they fit within the remaining buffer. A cra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1121 to 1140 of 6933.First page Next page

Published 2026-05-27T12:58:00.299Z. Updated 2026-06-14T17:52:15.329Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:52 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46071

KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB. However, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and clearing clean bits in vmcb12 is not architecturally defined. Move vmc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:57.316Z. Updated 2026-10-21T12:41:17.270Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46070

md/raid5: validate payload size before accessing journal metadata

In the Linux kernel, the following vulnerability has been resolved: md/raid5: validate payload size before accessing journal metadata r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a journal metadata block using on-disk payload size fields without validating …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:54.345Z. Updated 2026-10-19T19:26:42.780Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46069

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() The mwifiex_adapter_cleanup() function uses timer_delete() (non-synchronous) for the wakeup_timer before the adapter structure is freed. This is incorrect because timer_delete() does not …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:50.213Z. Updated 2026-10-15T01:20:20.801Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46068

crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx The bounce buffers are allocated with __get_free_pages() using BOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error path and nx842_crypto_free_ctx() release the b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:48.457Z. Updated 2026-06-14T17:51:58.785Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:51 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46067

mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp Users can set damos_quota_goal->nid with arbitrary value for node_memcg_{used,free}_bp. But DAMON core is using those for NODE-DATA() without a validation of the value. Thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:45.648Z. Updated 2026-06-14T17:51:55.381Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:51 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46066

ceph: fix num_ops off-by-one when crypto allocation fails

In the Linux kernel, the following vulnerability has been resolved: ceph: fix num_ops off-by-one when crypto allocation fails move_dirty_folio_in_page_array() may fail if the file is encrypted, the dirty folio is not the first in the batch, and it fails to allocate a bounce buffer to hold the ciphertext. When that ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:41.865Z. Updated 2026-10-21T12:41:16.157Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46065

fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an instance as part of initializing deferred I/O and remove it only after the final mapping has been closed.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:32.968Z. Updated 2026-10-19T19:26:42.635Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46064

ibmasm: fix heap over-read in ibmasm_send_i2o_message()

In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix heap over-read in ibmasm_send_i2o_message() The ibmasm_send_i2o_message() function uses get_dot_command_size() to compute the byte count for memcpy_toio(), but this value is derived from user-controlled fields in the dot_command_header (c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:30.247Z. Updated 2026-10-15T01:20:18.166Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:20 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46063

x86/shstk: Prevent deadlock during shstk sigreturn

In the Linux kernel, the following vulnerability has been resolved: x86/shstk: Prevent deadlock during shstk sigreturn During sigreturn the shadow stack signal frame is popped. The kernel does this by reading the shadow stack using normal read accesses. When it can't assume the memory is shadow stack, it takes extra …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:27.336Z. Updated 2026-06-14T17:51:37.005Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:51 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46062

ntfs3: fix integer overflow in run_unpack() volume boundary check

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix integer overflow in run_unpack() volume boundary check The volume boundary check `lcn + len > sbi->used.bitmap.nbits` uses raw addition which can wrap around for large lcn and len values, bypassing the validation. Use check_add_overflow()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:24.416Z. Updated 2026-08-05T12:29:26.689Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46061

jbd2: fix deadlock in jbd2_journal_cancel_revoke()

In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2_journal_cancel_revoke() Commit f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") changed jbd2_journal_cancel_revoke() to use __find_get_block_nonatomic() which holds the folio lock instead of i_private_lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:22.041Z. Updated 2026-06-14T17:51:27.666Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:51 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46060

crypto: qat - fix IRQ cleanup on 6xxx probe failure

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix IRQ cleanup on 6xxx probe failure When adf_dev_up() partially completes and then fails, the IRQ handlers registered during adf_isr_resource_alloc() are not detached before the MSI-X vectors are released. Since the device is enabled…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:20.991Z. Updated 2026-06-14T17:51:23.100Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:51 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46059

KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:19.928Z. Updated 2026-10-21T12:41:15.082Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46058

media: amphion: Fix race between m2m job_abort and device_run

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m job_abort and device_run Fix kernel panic caused by race condition where v4l2_m2m_ctx_release() frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run with the same context. Race sequence: v4l2_m2m_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:17.853Z. Updated 2026-08-05T12:29:25.621Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 27 May 2026, 19:57 WIB

CVE-2026-46057

landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() hook_cred_transfer() only copies the Landlock security blob when the source credential has a domain. This is inconsistent with landlock_restrict_self() which can set LOG_SUBDOMAINS_OFF on a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:16.076Z. Updated 2026-06-14T17:51:11.492Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:51 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46056

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:15.150Z. Updated 2026-10-19T19:26:42.490Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46055

apparmor: Fix string overrun due to missing termination

In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix string overrun due to missing termination When booting Ubuntu 26.04 with Linux 7.0-rc4 on an ARM64 Qualcomm Snapdragon X1 we see a string buffer overrun: BUG: KASAN: slab-out-of-bounds in aa_dfa_match (security/apparmor/match.c:535) Re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:13.671Z. Updated 2026-08-05T12:29:23.386Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

HighPublished 27 May 2026, 19:57 WIB

CVE-2026-46054

selinux: fix overlayfs mmap() and mprotect() access checks

In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the mounter's credentials are sufficient to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:57:12.813Z. Updated 2026-10-19T19:26:42.348Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record