Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2921–2940 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98949

drm/imagination: Fix reference and vm_bo handling in remap()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm_bo handling in remap() When a map overlaps part of an existing mapping, pvr_vm_gpuva_remap() splits the mapping into prev/next parts covering what the request did not take, instead of creating something new. It g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:08.946Z. Updated 2026-10-23T12:19:08.946Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98948

mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2921 to 2940 of 16156.First page Next page

Published 2026-10-23T12:19:08.043Z. Updated 2026-10-23T12:19:08.043Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98947

vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:06.146Z. Updated 2026-10-23T12:19:06.146Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98946

drm/vc4: Disable the V3D interrupt across runtime suspend

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler. syn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:05.190Z. Updated 2026-10-23T12:19:05.190Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:19 WIB

Official record

HighPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98945

HID: steam: Rearrange teardown sequence

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work cancel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:04.191Z. Updated 2026-10-26T06:56:55.094Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

HighPublished 23 Oct 2026, 19:19 WIB

CVE-2026-98944

HID: steam: Refactor registration

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the functio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:19:02.560Z. Updated 2026-10-26T06:56:53.861Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

LowPublished 23 Oct 2026, 19:16 WIB

CVE-2026-54711

PGHoard: Password written to debug log

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

Excerpt language: en.

Severity low: primary CNA CVSS 2.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:16:38.258Z. Updated 2026-10-23T12:16:38.258Z.

CVSS2.4v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:16 WIB

Official record

HighPublished 23 Oct 2026, 19:16 WIB

CVE-2026-63120

PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:16:36.584Z. Updated 2026-10-23T14:59:26.366Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:59 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:12 WIB

CVE-2026-98942

sched_ext: Build the cid tables privately and publish them with RCU

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init_cids() overrides rewrite them in place…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:12:14.180Z. Updated 2026-10-26T06:56:52.637Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

HighPublished 23 Oct 2026, 19:12 WIB

CVE-2026-98941

ext4: don't enable large folios on encrypted inodes

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mount…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:12:12.296Z. Updated 2026-10-24T14:09:34.434Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:12 WIB

CVE-2026-98940

ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver. When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:12:08.487Z. Updated 2026-10-23T12:12:08.487Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:12 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:12 WIB

CVE-2026-98939

x86/mm: Drop unnecessary PMD page copy when freeing

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap_read_lock() to kernel page prot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:12:06.180Z. Updated 2026-10-23T12:12:06.180Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:12 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98938

rust: irq: pass RegistrationInner as cookie to request_irq

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:59.043Z. Updated 2026-10-23T12:11:59.043Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:11 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98937

perf/core: Check kernel access when kernel callchains are requested

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel =…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:53.327Z. Updated 2026-10-26T06:56:51.396Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98936

wifi: ath11k: reset ar->num_stations on hardware start

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:48.632Z. Updated 2026-10-23T12:11:48.632Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:11 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98935

rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these hole…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:46.041Z. Updated 2026-10-23T12:11:46.041Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:11 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98934

ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: pl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:43.459Z. Updated 2026-10-23T12:11:43.459Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:11 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98933

usb: hub: use shorter 120ms post resume hold for SS root hubs

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:39.531Z. Updated 2026-10-23T12:11:39.531Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:11 WIB

Official record

HighPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98932

EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use altdev(dci->p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:35.940Z. Updated 2026-10-24T14:09:33.367Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:11 WIB

CVE-2026-98931

mtd: spinand: fix NULL pointer dereference with no ECC engine

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving nand->ecc.engine NULL. The SPI-NAND code neverth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:11:34.935Z. Updated 2026-10-23T12:11:34.935Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:11 WIB

Official record