Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 1341–1360 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50709

wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but ath9k_hif_usb_rx_stream() uses __dev_all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:23.194Z. Updated 2026-05-11T19:23:58.844Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50708

HSI: ssi_protocol: fix potential resource leak in ssip_pn_open()

In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: fix potential resource leak in ssip_pn_open() ssip_pn_open() claims the HSI client's port with hsi_claim_port(). When hsi_register_port_event() gets some error and returns a negetive value, the HSI client's port should be released …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1341 to 1360 of 5493.First page Next page

Published 2025-12-24T10:55:22.234Z. Updated 2026-05-11T19:23:57.688Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50707

virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()

In the Linux kernel, the following vulnerability has been resolved: virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() 'vc_ctrl_req' is alloced in virtio_crypto_alg_skcipher_close_session(), and should be freed in the invalid ctrl_status->status error handling case. Otherwise there is a memo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:21.547Z. Updated 2026-05-11T19:23:56.488Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50706

net/ieee802154: don't warn zero-sized raw_sendmsg()

In the Linux kernel, the following vulnerability has been resolved: net/ieee802154: don't warn zero-sized raw_sendmsg() syzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1], for PF_IEEE802154 socket's zero-sized raw_sendmsg() request is hitting __dev_queue_xmit() with skb->len == 0. Since PF_IEEE8021…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:20.835Z. Updated 2026-05-23T15:24:53.997Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:24 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50705

io_uring/rw: defer fsnotify calls to task context

In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: defer fsnotify calls to task context We can't call these off the kiocb completion as that might be off soft/hard irq context. Defer the calls to when we process the task_work for this request. That avoids valid complaints like: stack ba…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:20.020Z. Updated 2026-05-23T15:24:52.616Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:24 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50704

USB: gadget: Fix use-after-free during usb config switch

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free during usb config switch In the process of switching USB config from rndis to other config, if the hardware does not support the ->pullup callback, or the hardware encounters a low probability fault, both of them may c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:19.295Z. Updated 2026-05-11T19:23:52.960Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50703

soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() There are two refcount leak bugs in qcom_smsm_probe(): (1) The 'local_node' is escaped out from for_each_child_of_node() as the break of iteration, we should call of_node_put() for it in e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:18.548Z. Updated 2026-05-11T19:23:51.817Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50702

vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init()

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() Inject fault while probing module, if device_register() fails in vdpasim_net_init() or vdpasim_blk_init(), but the refcount of kobject is not decreased to 0, the name all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:17.831Z. Updated 2026-05-11T19:23:50.676Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

HighPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50701

wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host SDIO may need addtional 511 bytes to align bus operation. If the tailroom of this skb is not big enough, we would access invalid memory region. For low level operation, increase skb size…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:17.090Z. Updated 2026-10-15T21:41:23.201Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

HighPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50700

wifi: ath10k: Delay the unmapping of the buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has sent, this is leading i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:16.257Z. Updated 2026-10-15T21:41:23.069Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50699

selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()

In the Linux kernel, the following vulnerability has been resolved: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() The following warning was triggered on a hardware environment: SELinux: Converting 162 SID table entries... BUG: sleeping function called from invalid context at _…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:15.468Z. Updated 2026-05-11T19:23:44.480Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50698

ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()

In the Linux kernel, the following vulnerability has been resolved: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() If clk_hw_register() fails, the corresponding clk should not be unregistered. To handle errors from loops, clean up partial iterations before doing the goto. So add a clk_hw_unr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:14.740Z. Updated 2026-05-11T19:23:43.293Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:23 WIB

Official record

HighPublished 24 Dec 2025, 17:55 WIB

CVE-2022-50697

mrp: introduce active flags to prevent UAF when applicant uninit

In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be successful. And sy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:55:13.762Z. Updated 2026-10-15T21:41:22.920Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68733

smack: fix bug: unprivileged task can create labels

In the Linux kernel, the following vulnerability has been resolved: smack: fix bug: unprivileged task can create labels If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty), it can freely create new labels by writing their names into own /proc/PID/attr/smack/current This occurs bec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:15.347Z. Updated 2026-05-11T21:52:17.465Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:52 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68732

gpu: host1x: Fix race in syncpt alloc/free

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking. This ensures no thread can acquire the syncpt_mutex after the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:14.664Z. Updated 2026-05-11T21:52:16.287Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:52 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68731

accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() The unpublished smatch static checker reported a warning. drivers/accel/amdxdna/aie2_pci.c:904 aie2_query_ctx_status_array() warn: potential user controlled sizeof overflow 'arg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:13.964Z. Updated 2026-05-11T21:52:15.119Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:52 WIB

Official record

HighPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68730

accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Don't add BO to the vdev->bo_list in ivpu_gem_create_object(). When failure happens inside drm_gem_shmem_create(), the BO is not fully created and ivpu_gem_bo_free() callback will no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:13.236Z. Updated 2026-10-21T12:38:24.802Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:38 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68729

wifi: ath12k: Fix MSDU buffer types handling in RX error path

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix MSDU buffer types handling in RX error path Currently, packets received on the REO exception ring from unassociated peers are of MSDU buffer type, while the driver expects link descriptor type packets. These packets are not parsed f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:12.515Z. Updated 2026-10-21T12:38:23.713Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:38 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68728

ntfs3: fix uninit memory after failed mi_read in mi_format_new

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix uninit memory after failed mi_read in mi_format_new Fix a KMSAN un-init bug found by syzkaller. ntfs_get_bh() expects a buffer from sb_getblk(), that buffer may not be uptodate. We do not bring the buffer uptodate before setting it as upt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:11.847Z. Updated 2026-05-11T21:52:11.623Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:52 WIB

Official record

UnscoredPublished 24 Dec 2025, 17:33 WIB

CVE-2025-68727

ntfs3: Fix uninit buffer allocated by __getname()

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by __getname() Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T10:33:11.085Z. Updated 2026-05-11T21:52:10.402Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:52 WIB

Official record