Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2961–2980 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 23 Oct 2026, 19:01 WIB

CVE-2026-98918

mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in r->sampling_addr. damon_va_mkold() passes it into a page table walk, which hands i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T12:01:50.803Z. Updated 2026-10-23T12:05:05.149Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2026, 19:05 WIB

Official record

UnscoredPublished 23 Oct 2026, 19:01 WIB

CVE-2026-98917

parisc: Increase kernel stack size to 32kb

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vtk9 package with g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2961 to 2980 of 16156.First page Next page

Published 2026-10-23T12:01:46.420Z. Updated 2026-10-26T06:56:48.902Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

HighPublished 23 Oct 2026, 18:58 WIB

CVE-2026-56840

PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into that page. When a human opens the approval URL to inspect t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:58:24.568Z. Updated 2026-10-29T02:52:55.374Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:52 WIB

Official record

HighPublished 23 Oct 2026, 18:58 WIB

CVE-2026-56838

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_str…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:58:01.475Z. Updated 2026-10-29T13:53:23.978Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:53 WIB

Official record

HighPublished 23 Oct 2026, 18:57 WIB

CVE-2026-56837

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup only logs a warning and _handle_webhook() skips Linear-Signature verification entirely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:57:48.068Z. Updated 2026-10-23T21:05:27.023Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:05 WIB

Official record

HighPublished 23 Oct 2026, 18:57 WIB

CVE-2026-56836

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:57:28.192Z. Updated 2026-10-23T11:57:28.192Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 18:57 WIB

Official record

HighPublished 23 Oct 2026, 18:57 WIB

CVE-2026-56835

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:57:11.852Z. Updated 2026-10-29T02:50:43.187Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:50 WIB

Official record

HighPublished 23 Oct 2026, 18:56 WIB

CVE-2026-56834

PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:56:40.277Z. Updated 2026-10-29T13:05:52.903Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:05 WIB

Official record

HighPublished 23 Oct 2026, 18:56 WIB

CVE-2026-56833

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlyi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:56:09.502Z. Updated 2026-10-23T21:05:34.632Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:05 WIB

Official record

HighPublished 23 Oct 2026, 18:55 WIB

CVE-2026-56832

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:55:53.084Z. Updated 2026-10-23T11:55:53.084Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated23 Oct 2026, 18:55 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:55 WIB

CVE-2026-98916

wifi: nl80211: check link is beaconing for color change

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:55:20.958Z. Updated 2026-10-26T06:56:47.686Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:55 WIB

CVE-2026-98915

media: video-i2c: use vb2_video_unregister_device on driver removal

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during driver removal. This ens…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:55:16.281Z. Updated 2026-10-26T06:56:46.442Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:55 WIB

CVE-2026-98914

drm/amdgpu: cap ATOM command table nesting depth

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:55:10.630Z. Updated 2026-10-26T06:56:45.185Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:55 WIB

CVE-2026-98913

net: thunderx: fix PTP device ref leak in nicvf_probe()

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is leaked. Add a commo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:55:08.297Z. Updated 2026-10-26T06:56:43.960Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:55 WIB

CVE-2026-98912

ALSA: seq: oss: Reject reads that cannot fit the next event

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It currently stop…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:55:04.908Z. Updated 2026-10-26T06:56:42.752Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

HighPublished 23 Oct 2026, 18:54 WIB

CVE-2026-98911

dpaa2-switch: fix the error path in dpaa2_switch_rx()

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since the dpaa2_switch_free_fd() is intended to be used on Tx fra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:54:57.029Z. Updated 2026-10-26T06:56:41.537Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:54 WIB

CVE-2026-98910

drm/amdkfd: Unwind debug trap enable on copy_to_user failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug eve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:54:50.520Z. Updated 2026-10-26T06:56:40.297Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:54 WIB

CVE-2026-98909

net: cpsw_new: unregister devlink on port registration failure

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resource…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:54:47.326Z. Updated 2026-10-26T06:56:39.086Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:54 WIB

CVE-2026-98908

net: microchip: sparx5: clean up PSFP resources on flower setup failure

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:54:46.243Z. Updated 2026-10-26T06:56:37.786Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record

UnscoredPublished 23 Oct 2026, 18:54 WIB

CVE-2026-98907

btrfs: protect sb_write_pointer() with invalidate lock

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 ("btrfs: sync …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-23T11:54:44.224Z. Updated 2026-10-26T06:56:36.536Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 13:56 WIB

Official record