Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2941–2960 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 23 Oct 2026, 19:10 WIB

CVE-2026-57117

PraisonAI: Compute-bridged file tools allow shell command injection

PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:10:18.920Z. Updated 2026-10-23T12:10:18.920Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:10 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:08 WIB

CVE-2026-98930

KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the K…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2941 to 2960 of 16156.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:08:17.513Z. Updated 2026-10-23T12:08:17.513Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:08 WIB

Official record

HighPublished 23 Oct 2026, 19:08 WIB

CVE-2026-57146

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:08:16.479Z. Updated 2026-10-23T12:08:16.479Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:08 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:08 WIB

CVE-2026-98929

macsec: initialize SecY before registering the netdevice

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default. register_netdevice() invok…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:08:11.551Z. Updated 2026-10-23T12:08:11.551Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:08 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:08 WIB

CVE-2026-98928

KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has_sve() reads the fla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:08:09.412Z. Updated 2026-10-23T12:08:09.412Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:08 WIB

Official record

HighPublished 23 Oct 2026, 19:07 WIB

CVE-2026-57144

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:07:55.583Z. Updated 2026-10-29T02:55:07.333Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:55 WIB

Official record

HighPublished 23 Oct 2026, 19:07 WIB

CVE-2026-57142

PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_dangerous_tools=True. That policy only checks tools declared in TEMPLATE.yaml requires.to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:07:46.547Z. Updated 2026-10-29T13:12:14.267Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:12 WIB

Official record

HighPublished 23 Oct 2026, 19:07 WIB

CVE-2026-57121

PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:07:27.854Z. Updated 2026-10-23T14:59:32.712Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:59 WIB

Official record

CritPublished 23 Oct 2026, 19:06 WIB

CVE-2026-57116

PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.mess…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:06:55.544Z. Updated 2026-10-29T02:53:53.826Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:53 WIB

Official record

HighPublished 23 Oct 2026, 19:06 WIB

CVE-2026-98927

KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for whole guest, which implies that they ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:06:01.528Z. Updated 2026-10-24T14:09:32.255Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 21:09 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:05 WIB

CVE-2026-98926

drm/amd/display: Remove sink usage from DPMS

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream->sink->link, which can be replaced with strea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:05:54.511Z. Updated 2026-10-26T06:56:50.146Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:05 WIB

CVE-2026-98925

bpf, sockmap: Fix self-redirect copied_seq double-counting

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:05:53.207Z. Updated 2026-10-23T12:05:53.207Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

HighPublished 23 Oct 2026, 19:04 WIB

CVE-2026-57114

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:04:29.966Z. Updated 2026-10-29T13:09:28.257Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:09 WIB

Official record

HighPublished 23 Oct 2026, 19:04 WIB

CVE-2026-57113

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:04:04.048Z. Updated 2026-10-23T14:59:39.455Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 21:59 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:03 WIB

CVE-2026-98924

fs: avoid repeated scans in evict_inodes()

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bdev_mark_dead() calls evict_inodes() while holding s_umount.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:03:50.230Z. Updated 2026-10-23T12:05:50.501Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:03 WIB

CVE-2026-98923

arm64: io: Reject non-user protection in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys(): WARNING: ./a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:03:28.027Z. Updated 2026-10-23T12:05:45.179Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:03 WIB

CVE-2026-98922

net: emac: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad area, sig: 11 [#1] |…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:03:02.790Z. Updated 2026-10-23T12:05:38.754Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:02 WIB

CVE-2026-98921

ovl: fix UAF in ovl_do_mkdir() debug print

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:02:38.969Z. Updated 2026-10-23T12:05:33.583Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:02 WIB

CVE-2026-98920

netfs: Fix missing alloc tagging of direct mempool allocations

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:02:06.560Z. Updated 2026-10-23T12:05:25.919Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:01 WIB

CVE-2026-98919

drm/xe: harden adjust_idledly() against divide-by-zero and overflow

In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which mak…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:01:55.092Z. Updated 2026-10-23T12:05:08.723Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record