Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2861–2880 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99009

Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between rfcomm_mutex and hdev-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:34.301Z. Updated 2026-10-23T12:20:34.301Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99008

Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2861 to 2880 of 16156.First page Next page

Published 2026-10-23T12:20:33.355Z. Updated 2026-10-23T12:20:33.355Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99007

drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN __drm_fb_helper_initial_config_and_unlock() calls drm_client_modeset_probe() first, which already fills in each mode_set->mode/num_connectors for every connected output, and onl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:32.381Z. Updated 2026-10-23T12:20:32.381Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

HighPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99006

drm/i915/gem: Prevent overstepping exec array boundary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow(): 1) eb_copy_relocations() alloca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:31.415Z. Updated 2026-10-24T14:09:58.315Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99005

drm/i915/gt: Unmask interrupts only when ACTIVE is true

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This mean…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:30.462Z. Updated 2026-10-23T12:20:30.462Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99004

drm/imagination: Size page table preallocation by device address

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvr_mmu_op_context_create(), but the preallocation is still sized…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:29.122Z. Updated 2026-10-23T12:20:29.122Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99003

drm/panthor: validate userspace queue count against initialized firmware slot count

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:24.476Z. Updated 2026-10-23T12:20:24.476Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

HighPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99002

drm/vmwgfx: validate pitch coming from userspace

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:22.763Z. Updated 2026-10-24T14:09:57.241Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99001

drm/xe/i2c: cancel the client work on remove

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->work when the adapter is registered under the xe I2C platform device, and xe_i2c_client_work() then instantiates the AMC c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:21.753Z. Updated 2026-10-23T12:20:21.753Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-99000

drm/xe: Fix shrinker accounting double-subtraction on nested external pins

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count refcount rather than a boolean. Howe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:20.753Z. Updated 2026-10-23T12:20:20.753Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

HighPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98999

drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's pinned_link list membership in xe->pinned.late.external, based on whether the current call is the outermost pin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:19.451Z. Updated 2026-10-24T14:09:56.167Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98998

drm/bridge: th1520-dw-hdmi: Fix remove() callback

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform drvdata, but th1520_dw_hdmi_remove() was reading it back as struct dw_hdmi * and passing it to dw_hdmi_remove(), so teardown runs on the wrong point…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:18.352Z. Updated 2026-10-23T12:20:18.352Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98997

drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents are lost. Since an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:16.267Z. Updated 2026-10-23T12:20:16.267Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98996

fs: don't silently unmount busy mounts

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those functions from propa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:15.188Z. Updated 2026-10-23T12:20:15.188Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

HighPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98995

namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount of the parent when it unmounts the mount that overmounts it. mnt_change_mountpoint() doesn't. It moves the mount to its new parent and leaves t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:14.155Z. Updated 2026-10-24T14:09:55.095Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98994

statmount: read the parent of an unmounted mount under mount_lock

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt_parent with namespace_sem held for reading. That's fine for a mount that is in a namespace. Everything above it is pinn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:13.244Z. Updated 2026-10-23T12:20:13.244Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

HighPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98993

namespace: don't inherit MNT_UMOUNT in clone_mnt()

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never cleared. __detach_mounts() unhooks a mount that carries it instead of unmounting it. d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:12.266Z. Updated 2026-10-24T14:09:54.039Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98992

namespace: don't copy an unmounted mount tree

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no mount namespace so …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:11.256Z. Updated 2026-10-23T12:20:11.256Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record

HighPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98991

namespace: queue a mount only once for mount notifications

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per namespace_sem hold. It i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:10.289Z. Updated 2026-10-24T14:09:52.901Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:20 WIB

CVE-2026-98990

namespace: check a submount for references right before unmounting it

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and mark_mounts_for_expiry() first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by propagate_mou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:20:09.349Z. Updated 2026-10-23T12:20:09.349Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:20 WIB

Official record