Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1321–1340 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 27 May 2026, 19:17 WIB

CVE-2026-45889

mptcp: do not account for OoO in mptcp_rcvbuf_grow()

In the Linux kernel, the following vulnerability has been resolved: mptcp: do not account for OoO in mptcp_rcvbuf_grow() MPTCP-level OoOs are physiological when multiple subflows are active concurrently and will not cause retransmissions nor are caused by drops. Accounting for them in mptcp_rcvbuf_grow() causes the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:17:00.509Z. Updated 2026-05-27T12:17:00.509Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:17 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45888

md/raid1: fix memory leak in raid1_run()

In the Linux kernel, the following vulnerability has been resolved: md/raid1: fix memory leak in raid1_run() raid1_run() calls setup_conf() which registers a thread via md_register_thread(). If raid1_set_limits() fails, the previously registered thread is not unregistered, resulting in a memory leak of the md_thread …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1321 to 1340 of 6933.First page Next page

Published 2026-05-27T12:16:59.751Z. Updated 2026-05-27T12:16:59.751Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45887

af_unix: Fix memleak of newsk in unix_stream_connect().

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix memleak of newsk in unix_stream_connect(). When prepare_peercred() fails in unix_stream_connect(), unix_release_sock() is not called for newsk, and the memory is leaked. Let's move prepare_peercred() before unix_create1().

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:58.720Z. Updated 2026-05-27T12:16:58.720Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45886

bpf: Fix bpf_xdp_store_bytes proto for read-only arg

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_xdp_store_bytes proto for read-only arg While making some maps in Cilium read-only from the BPF side, we noticed that the bpf_xdp_store_bytes proto is incorrect. In particular, the verifier was throwing the following error: ; ret = ct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:58.000Z. Updated 2026-05-27T12:16:58.000Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45885

power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()

In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:57.246Z. Updated 2026-05-27T12:16:57.246Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45884

apparmor: avoid per-cpu hold underflow in aa_get_buffer

In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid per-cpu hold underflow in aa_get_buffer When aa_get_buffer() pulls from the per-cpu list it unconditionally decrements cache->hold. If hold reaches 0 while count is still non-zero, the unsigned decrement wraps to UINT_MAX. This keeps …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:56.542Z. Updated 2026-05-27T12:16:56.542Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45883

iio: sca3000: Fix a resource leak in sca3000_probe()

In the Linux kernel, the following vulnerability has been resolved: iio: sca3000: Fix a resource leak in sca3000_probe() spi->irq from request_threaded_irq() not released when iio_device_register() fails. Add an return value check and jump to a common error handler when iio_device_register() fails.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:55.840Z. Updated 2026-05-27T12:16:55.840Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45882

power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()

In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:55.144Z. Updated 2026-05-27T12:16:55.144Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45881

soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()

In the Linux kernel, the following vulnerability has been resolved: soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() In svs_enable_debug_write(), the buf allocated by memdup_user_nul() is leaked if kstrtoint() fails. Fix this by using __free(kfree) to automatically free buf, eliminating the need for e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:53.677Z. Updated 2026-05-27T12:16:53.677Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45880

PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails

In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap() doesn't invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired after gen_pool_alloc_owner(), and memu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:52.117Z. Updated 2026-05-27T12:16:52.117Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45879

power: supply: bq25980: Fix use-after-free in power_supply_changed()

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25980: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be dealloca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:50.137Z. Updated 2026-05-27T12:16:50.137Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

HighPublished 27 May 2026, 19:16 WIB

CVE-2026-45878

drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int and checked bits by shifting with watch_id. If a very lar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:49.108Z. Updated 2026-10-19T19:26:39.200Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 02:26 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45877

HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients During a warm reset flow, the cl->device pointer may be NULL if the reset occurs while clients are still being enumerated. Accessing cl->device->reference_count without a NULL che…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:46.910Z. Updated 2026-10-21T12:40:54.404Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:40 WIB

Official record

UnscoredPublished 27 May 2026, 19:16 WIB

CVE-2026-45876

arm64/gcs: Fix error handling in arch_set_shadow_stack_status()

In the Linux kernel, the following vulnerability has been resolved: arm64/gcs: Fix error handling in arch_set_shadow_stack_status() alloc_gcs() returns an error-encoded pointer on failure, which comes from do_mmap(), not NULL. The current NULL check fails to detect errors, which could lead to using an invalid GCS ad…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:16:43.350Z. Updated 2026-05-27T12:16:43.350Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:16 WIB

Official record

UnscoredPublished 27 May 2026, 19:15 WIB

CVE-2026-45875

mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure

In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure The wm5102_clear_write_sequencer() helper may return an error and just return, bypassing the cleanup sequence and causing regulators to remain enabled, leading to a r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:15:56.675Z. Updated 2026-05-27T12:15:56.675Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:15 WIB

Official record

UnscoredPublished 27 May 2026, 19:15 WIB

CVE-2026-45874

phy: freescale: imx8qm-hsio: fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: phy: freescale: imx8qm-hsio: fix NULL pointer dereference During the probe the refclk_pad pointer is set to NULL if the 'fsl,refclk-pad-mode' property is not defined in the devicetree node. But in imx_hsio_configure_clk_pad() this pointer is uncondit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:15:53.604Z. Updated 2026-05-27T12:15:53.604Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:15 WIB

Official record

UnscoredPublished 27 May 2026, 19:15 WIB

CVE-2026-45873

netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:15:52.916Z. Updated 2026-05-27T12:15:52.916Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:15 WIB

Official record

UnscoredPublished 27 May 2026, 19:15 WIB

CVE-2026-45872

scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when the allocation for rpl_16byte_wwid_list fails. These early returns bypass the c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:15:52.133Z. Updated 2026-05-27T12:15:52.133Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:15 WIB

Official record

UnscoredPublished 27 May 2026, 19:15 WIB

CVE-2026-45871

tpm: st33zp24: Fix missing cleanup on get_burstcount() error

In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Fix missing cleanup on get_burstcount() error get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier. Use goto out_err to ensure proper cleanu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:15:51.317Z. Updated 2026-05-27T12:15:51.317Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:15 WIB

Official record

UnscoredPublished 27 May 2026, 19:15 WIB

CVE-2026-45870

SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(). When a subsequent decode operation fails, these function…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T12:15:50.199Z. Updated 2026-05-27T12:15:50.199Z.

CVSS—KEVNot listedEPSSPresentUpdated27 May 2026, 19:15 WIB

Official record