Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2901–2920 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98969

net/sched: em_text: reject unterminated algo before autoload

In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised the dump-side struct. Sashiko pointed at a pre-existing bug …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:42.012Z. Updated 2026-10-23T12:19:42.012Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

HighPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98968

amt: send the relay's General Query directly from the receive path

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmp_qrv set to 1 on the relay a tunnel lives for 135s, so a netem de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2901 to 2920 of 16156.First page Next page

Published 2026-10-23T12:19:39.236Z. Updated 2026-10-24T14:09:43.037Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98967

cxgb4/ch_ktls: disable softirqs around tid_list erases

In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_LOCK_BH. However, c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:37.625Z. Updated 2026-10-23T12:19:37.625Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98966

bonding: fix the program leak when XDP is replaced

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation series (leaked progra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:36.024Z. Updated 2026-10-23T12:19:36.024Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

HighPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98965

ice: Restore Ordered MMIO Writes for Tx Doorbells

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queue(). Subsequently th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:34.754Z. Updated 2026-10-24T14:09:41.904Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

HighPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98964

nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails, out_free_sg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:32.374Z. Updated 2026-10-24T14:09:40.850Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98963

btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, it calls btrfs_uring_read_extent_endio() and previously returned the I/O status. A negative errno then m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:31.392Z. Updated 2026-10-23T12:19:31.392Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98962

btrfs: free iov when btrfs_uring_read_extent() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure, fall thr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:30.482Z. Updated 2026-10-23T12:19:30.482Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98961

btrfs: unlock inode and extent in caller when io_uring read extent fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken the inode shared lock and the extent lock. On failure it used to unlock in out_fail, and a pages-array …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:29.616Z. Updated 2026-10-23T12:19:29.616Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98960

btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU allocations on clean…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:28.651Z. Updated 2026-10-23T12:19:28.651Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

CritPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98959

btrfs: fix xattr replace when multiple xattrs are packed in the same item

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the setxattr(2) family of syscalls) with another value of a diffe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:27.679Z. Updated 2026-10-24T14:09:39.735Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98958

wifi: mt76: account non-AQL frames per peer rather than per link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid->non_aql_packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware reports the complet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:26.256Z. Updated 2026-10-23T12:19:26.256Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98957

wifi: mt76: mt7915: disable rx napi when removing device

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in __netif_napi_del_locked() and in page_pool_disable_direct_recycling() because the driver does not disable the napi before d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:22.400Z. Updated 2026-10-23T12:19:22.400Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98956

ASoC: adau1372: allow sleepy powerdown GPIOs

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod_set_value() emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process context, use the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:20.208Z. Updated 2026-10-23T12:19:20.208Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98955

flow_dissector: avoid u16 truncation of skb->len when computing thoff

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); min_t(u16, ...) casts both arguments to u16 before compar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:15.287Z. Updated 2026-10-23T12:19:15.287Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98954

net: always dissect GSO packets in __virtio_net_hdr_to_skb()

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264 ("net: avoid false positives in untrusted gso validation") added a '&& skb->network_header' check before flow-dissecting GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:13.873Z. Updated 2026-10-23T12:19:13.873Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98953

devlink: fix devlink_rel reference leak when notify work is pending

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink_rel reference leak when notify work is pending devlink_rel_nested_in_notify_work_schedule() takes a reference on the devlink_rel for the notify work and then queues the work, ignoring the return value of schedule_delayed_work(). …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:13.015Z. Updated 2026-10-23T12:19:13.015Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

HighPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98952

pfcp: make sure the SEID is linear before reading it

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp_encap_recv() only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcp_session_recv() then reads the 8 byte SEID that follows, which i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:12.127Z. Updated 2026-10-24T14:09:37.815Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98951

riscv: ptrace: Zero-initialize regset buffers before copyin

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is valida…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:10.747Z. Updated 2026-10-23T12:19:10.747Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98950

flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. F…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:09.890Z. Updated 2026-10-23T12:19:09.890Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record