Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1181–1200 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46014

KVM: SVM: Add missing save/restore handling of LBR MSRs

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Add missing save/restore handling of LBR MSRs MSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So save/restore is completely broken. Fix it by adding th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:16.052Z. Updated 2026-10-21T12:41:11.773Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46013

mm/memfd_luo: fix physical address conversion in put_folios cleanup

In the Linux kernel, the following vulnerability has been resolved: mm/memfd_luo: fix physical address conversion in put_folios cleanup In memfd_luo_retrieve_folios()'s put_folios cleanup path: 1. kho_restore_folio() expects a phys_addr_t (physical address) but receives a raw PFN (pfolio->pfn). This causes kho_re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1181 to 1200 of 6933.First page Next page

Published 2026-05-27T12:56:15.236Z. Updated 2026-06-14T17:47:59.320Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46012

rxrpc: Fix memory leaks in rxkad_verify_response()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix memory leaks in rxkad_verify_response() Fix rxkad_verify_response() to free the ticket and the server key under all circumstances by initialising the ticket pointer to NULL and then making all paths through the function after the first all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:14.131Z. Updated 2026-06-14T17:47:55.135Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

HighPublished 27 May 2026, 19:56 WIB

CVE-2026-46011

media: mtk-jpeg: fix use-after-free in release path due to uncancelled work

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: fix use-after-free in release path due to uncancelled work The mtk_jpeg_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->jpeg_work. This creates a race window where the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:13.198Z. Updated 2026-08-05T12:29:08.321Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

HighPublished 27 May 2026, 19:56 WIB

CVE-2026-46010

rxrpc: Fix error handling in rxgk_extract_token()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix error handling in rxgk_extract_token() Fix a missing bit of error handling in rxgk_extract_token(): in the event that rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather than continuing on (for anything else, it generates…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:11.456Z. Updated 2026-08-05T12:29:07.239Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46009

PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown

In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown epf_ntb_epc_destroy() duplicates the teardown that the caller is supposed to do later. This leads to an oops when .allow_link fails or when .drop_link is performed. Remove the helper. Al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:09.581Z. Updated 2026-06-14T17:47:44.154Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46008

mm/damon/core: fix damos_walk() vs kdamond_fn() exit race

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix damos_walk() vs kdamond_fn() exit race When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the damon_ctx->kdamond so that API callers and API functions themselves can show the cont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:08.315Z. Updated 2026-10-21T12:41:10.467Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:41 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46007

hwmon: (powerz) Avoid cacheline sharing for DMA buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: (powerz) Avoid cacheline sharing for DMA buffer Depending on the architecture the transfer buffer may share a cacheline with the following mutex. As the buffer may be used for DMA, that is problematic. Use the high-level DMA helpers to make s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:06.623Z. Updated 2026-06-14T17:47:37.205Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

HighPublished 27 May 2026, 19:56 WIB

CVE-2026-46006

drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check nouveau_gem_pushbuf_reloc_apply() validates each relocation with if (r->reloc_bo_offset + 4 > nvbo->bo.base.size) but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:05.273Z. Updated 2026-08-05T12:29:06.114Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46005

xfs: fix a resource leak in xfs_alloc_buftarg()

In the Linux kernel, the following vulnerability has been resolved: xfs: fix a resource leak in xfs_alloc_buftarg() In the error path, call fs_put_dax() to drop the DAX device reference.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:03.201Z. Updated 2026-06-19T11:58:58.503Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:58 WIB

Official record

UnscoredPublished 27 May 2026, 19:56 WIB

CVE-2026-46004

ALSA: caiaq: Handle probe errors properly

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setup_card() in caiaq driver doesn't treat the error cases gracefully, e.g. the error from snd_card_register() calls snd_card_free() but continues. This would lead to a UAF for the fur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:01.851Z. Updated 2026-06-14T17:47:26.278Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

MedPublished 27 May 2026, 19:56 WIB

CVE-2026-9704

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:56:00.858Z. Updated 2026-06-26T06:46:25.912Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated26 Jun 2026, 13:46 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-46003

net: qrtr: ns: Limit the total number of nodes

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameserver doesn't limit the number of nodes it handles. This can be an attack vector if a malicious client starts registering random nodes, leading to memory exhaustion. Hence, limit the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:59.509Z. Updated 2026-10-15T01:19:54.582Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:19 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-46002

ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()

In the Linux kernel, the following vulnerability has been resolved: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() ext2_iget() already rejects inodes with i_nlink == 0 when i_mode is zero or i_dtime is set, treating them as deleted. However, the case of i_nlink == 0 with a non-zero mode and zero …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:57.898Z. Updated 2026-06-14T17:47:19.832Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-46001

hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs in pt5161l_read_block_data(): 1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24], but i2c_smbus_read_block_data() can return up to I2C_SMBUS_BLOCK_MAX (32) by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:56.128Z. Updated 2026-06-14T17:47:16.457Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-46000

rxrpc: Fix conn-level packet handling to unshare RESPONSE packets

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix conn-level packet handling to unshare RESPONSE packets The security operations that verify the RESPONSE packets decrypt bits of it in place - however, the sk_buff may be shared with a packet sniffer, which would lead to the sniffer seeing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:55.288Z. Updated 2026-06-14T17:47:13.061Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:47 WIB

Official record

HighPublished 27 May 2026, 19:55 WIB

CVE-2026-45999

erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

In the Linux kernel, the following vulnerability has been resolved: erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:53.846Z. Updated 2026-08-05T12:29:04.993Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:29 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-45998

rxrpc: Fix potential UAF after skb_unshare() failure

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread()) will be NULL'd out. This will likely cause the call …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:52.756Z. Updated 2026-09-16T12:04:16.191Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Sep 2026, 19:04 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-45997

scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails If device_add(&sdkp->disk_dev) fails, put_device() runs scsi_disk_release(), which frees the scsi_disk but leaves the gendisk referenced. The device_add_disk() error path in sd_probe()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:51.154Z. Updated 2026-10-15T01:19:51.836Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:19 WIB

Official record

UnscoredPublished 27 May 2026, 19:55 WIB

CVE-2026-45996

spi: imx: fix use-after-free on unbind

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix use-after-free on unbind The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). Take another reference before deregistering the controller so …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:55:50.195Z. Updated 2026-06-19T11:58:52.649Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:58 WIB

Official record