Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2781–2800 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 23 Oct 2026, 19:45 WIB

CVE-2026-99083

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:45:01.735Z. Updated 2026-10-26T06:56:58.783Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

HighPublished 23 Oct 2026, 19:45 WIB

CVE-2026-99082

KVM: x86: Use active memslots for the per-vCPU MMIO cache

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm_memslots(), which unconditi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2781 to 2800 of 16156.First page Next page

Published 2026-10-23T12:45:00.798Z. Updated 2026-10-24T14:10:23.875Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

HighPublished 23 Oct 2026, 19:35 WIB

CVE-2026-55888

XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host (limited to files the user has access to). The FileChooser.SaveFiles method takes optional filenames whic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:35:23.077Z. Updated 2026-10-23T12:35:23.077Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:35 WIB

Official record

HighPublished 23 Oct 2026, 19:35 WIB

CVE-2026-55889

XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:35:05.502Z. Updated 2026-10-23T14:59:19.599Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:59 WIB

Official record

HighPublished 23 Oct 2026, 19:28 WIB

CVE-2026-57210

Heimdall: IP Spoofing via Unvalidated Forwarding Headers

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:28:09.427Z. Updated 2026-10-29T02:57:12.693Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:57 WIB

Official record

HighPublished 23 Oct 2026, 19:27 WIB

CVE-2026-57209

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string wit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:27:19.621Z. Updated 2026-10-29T13:16:52.579Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:16 WIB

Official record

MedPublished 23 Oct 2026, 19:24 WIB

CVE-2026-55190

Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetche…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:24:27.295Z. Updated 2026-10-29T13:14:00.254Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:14 WIB

Official record

HighPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99081

bnxt_en: fix DMA mapping length for padded small packets

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: [DMA Read NO_PASID] Request device [18:00.0] …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:28.347Z. Updated 2026-10-24T14:10:22.790Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99080

fs: Free any excess xarray nodes in clear_inode()

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with madvise. Rather th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:27.393Z. Updated 2026-10-26T06:56:57.576Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

CritPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99079

net/mlx5e: Prevent stale XSK buffer release on refill retry

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx5e also releases the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:26.458Z. Updated 2026-10-24T14:10:21.247Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

CritPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99078

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced and a later NAPI pol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:25.542Z. Updated 2026-10-24T14:10:20.145Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

HighPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99077

ipv4: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:22.773Z. Updated 2026-10-26T15:13:01.358Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 22:13 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99076

ipv6: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the kernel can match the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:19.727Z. Updated 2026-10-23T12:23:19.727Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99075

rust_binder: reschedule node refcount update on thread exit

In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits via BINDER_THREAD_EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment (e.g. pushed as deferred work to that thre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:18.830Z. Updated 2026-10-23T12:23:18.830Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99074

ipv4: stop PMTU walk when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path. For nexthop objects, fib_info_num_path() and fib_info_nhc() indepen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:17.866Z. Updated 2026-10-23T12:23:17.866Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99073

ipv4: stop exception dump when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib_dump_info_fnhe() uses fib_info_num_path() as the loo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:16.935Z. Updated 2026-10-23T12:23:16.935Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99072

ipv4: stop route notification sizing when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifications. fib_nlmsg_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:15.735Z. Updated 2026-10-23T12:23:15.735Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99071

ipv4: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route notifications for hardware flag changes. fib_alias_hw_flags_set() sizes the skb with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:14.297Z. Updated 2026-10-23T12:23:14.297Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99070

ipv6: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow the group between thes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:13.342Z. Updated 2026-10-23T12:23:13.342Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99069

Input: ati_remote2 - fix type confusion in device attribute handlers

In the Linux kernel, the following vulnerability has been resolved: Input: ati_remote2 - fix type confusion in device attribute handlers Previously, the channel_mask and mode_mask attributes were registered on the parent usb_device via sysfs_create_group(). When commit b20d6bf8014b ("Input: ati-remote2 - use driver c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:12.396Z. Updated 2026-10-23T12:23:12.396Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record