Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2801–2820 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99068

ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the DAO input mapper clearing logic in dao_clear_input(), but omitted the kfree() calls…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:11.461Z. Updated 2026-10-23T12:23:11.461Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99067

btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() When paths_from_inode() fails, scrub_print_warning_inode() jumps to err without dropping the reference taken by btrfs_get_fs_root(), leaking a reference to the root every time…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2801 to 2820 of 16156.First page Next page

Published 2026-10-23T12:23:10.430Z. Updated 2026-10-23T12:23:10.430Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99066

can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: init_can_skb(): restore skb header initialization Commit 9f10374bb024 ("can: remove private CAN skb headroom infrastructure") removed the skb_reset_mac_header()/skb_reset_network_header()/ skb_reset_transport_header() calls from init_can_sk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:09.516Z. Updated 2026-10-23T12:23:09.516Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99065

cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset hotplug operation becomes synchronous. That commit also removes the code that handles…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:08.458Z. Updated 2026-10-23T12:23:08.458Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

HighPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99064

cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a seven-byte RR opt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:05.854Z. Updated 2026-10-24T14:10:17.979Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99063

dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(struct dm_ioctl). get…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:04.655Z. Updated 2026-10-23T12:23:04.655Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:23 WIB

CVE-2026-99062

vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream receive, rx_bytes tracks the unread suffix while buf_used and peer credit still cover the whole packet. virtio_transport_read_skb() dequeues that packet but passes pkt_len f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:23:03.360Z. Updated 2026-10-23T12:23:03.360Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:23 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99061

wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:59.770Z. Updated 2026-10-23T12:22:59.770Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99060

wifi: mt76: mt7603: initialize global station WCID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:49.164Z. Updated 2026-10-23T12:22:49.164Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99059

wireguard: noise: reject response consumption after intermediate initiation

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partway through, and durin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:47.559Z. Updated 2026-10-24T14:10:16.832Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99058

workqueue: Fix NULL current_pwq deref in chained work check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:45.920Z. Updated 2026-10-23T12:22:45.920Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99057

xen/netfront: don't leak the skb when xennet_fill_frags() fails

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:44.683Z. Updated 2026-10-23T12:22:44.683Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99056

strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:42.234Z. Updated 2026-10-24T14:10:15.756Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99055

tcp: reject net_iov in zerocopy receive mapping hints

In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the next skb is unreadable, find_next_mappable_frag() passes its …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:39.451Z. Updated 2026-10-23T12:22:39.451Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99054

tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more wor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:36.886Z. Updated 2026-10-24T14:10:14.659Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99053

tipc: hold a reference to nodes found by link name

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers then lock and access the node, racing with t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:35.462Z. Updated 2026-10-24T14:10:13.569Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99052

selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem exported with security_label is mounted a second time, sget_fc() returns the existing superblock and nfs_get_root() calls security_sb_set_mnt_opts() ag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:34.168Z. Updated 2026-10-23T12:22:34.168Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99051

fsverity: RCU-delay the freeing of struct fsverity_info

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn't directly synchronize with fsverity_remove_info(). For the same inode this isn't a problem: its …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:30.370Z. Updated 2026-10-24T14:10:12.469Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

HighPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99050

gpio: mpsse: fix race when arming the IRQ poll worker

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it mis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:29.204Z. Updated 2026-10-24T14:10:11.370Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:22 WIB

CVE-2026-99049

gpio: xilinx: fix runtime PM leak on request error path

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:22:26.409Z. Updated 2026-10-23T12:22:26.409Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:22 WIB

Official record