Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3441–3460 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39716

parisc: Revise __get_user() to probe user read access

In the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never tri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:23.429Z. Updated 2026-05-12T12:06:33.619Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39715

parisc: Revise gateway LWS calls to probe user read access

In the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3441 to 3460 of 4319.First page Next page

Published 2025-09-05T17:21:22.330Z. Updated 2026-05-12T12:06:32.491Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39714

media: usbtv: Lock resolution while streaming

In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increase…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:21.435Z. Updated 2026-08-05T12:04:47.367Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39713

media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()

In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:20.459Z. Updated 2026-05-12T12:06:30.232Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39712

media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval

In the Linux kernel, the following vulnerability has been resolved: media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval Getting / Setting the frame interval using the V4L2 subdev pad ops get_frame_interval/set_frame_interval causes a deadlock, as the subdev state is locked in the [1] but also in the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:19.494Z. Updated 2026-05-11T21:34:48.122Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39711

media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls

In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:18.348Z. Updated 2026-08-05T12:04:46.297Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39710

media: venus: Add a check for packet size after reading from shared memory

In the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provide…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:17.243Z. Updated 2026-08-05T12:04:45.237Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

MedPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39709

media: venus: protect against spurious interrupts during probe

In the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:16.153Z. Updated 2026-08-05T12:04:44.157Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39708

media: iris: Fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix NULL pointer dereference A warning reported by smatch indicated a possible null pointer dereference where one of the arguments to API "iris_hfi_gen2_handle_system_error" could sometimes be null. To fix this, add a check to validate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:15.082Z. Updated 2026-05-11T21:34:43.474Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39707

drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities HUBBUB structure is not initialized on DCE hardware, so check if it is NULL to avoid null dereference while accessing amdgpu_dm_capabilities file in debugfs.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:13.958Z. Updated 2026-05-11T21:34:42.331Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39706

drm/amdkfd: Destroy KFD debugfs after destroy KFD wq

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:12.841Z. Updated 2026-05-12T12:06:26.796Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39705

drm/amd/display: fix a Null pointer dereference vulnerability

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a Null pointer dereference vulnerability [Why] A null pointer dereference vulnerability exists in the AMD display driver's (DC module) cleanup function dc_destruct(). When display control context (dc->ctx) construction fails (due…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:11.767Z. Updated 2026-10-21T12:37:16.991Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39704

LoongArch: KVM: Fix stack protector issue in send_ipi_data()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix stack protector issue in send_ipi_data() Function kvm_io_bus_read() is called in function send_ipi_data(), buffer size of parameter *val should be at least 8 bytes. Since some emulation functions like loongarch_ipi_readl() and kvm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:10.890Z. Updated 2026-08-05T12:04:43.088Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

CritPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39703

net, hsr: reject HSR frame if skb can't hold tag

In the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff88804241…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:09.768Z. Updated 2026-10-15T22:02:30.781Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

CritPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39702

ipv6: sr: Fix MAC comparison to be constant-time

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:08.674Z. Updated 2026-10-15T22:02:30.641Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39701

ACPI: pfr_update: Fix the driver update version check

In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:07.580Z. Updated 2026-05-12T12:06:23.158Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39700

mm/damon/ops-common: ignore migration request to invalid nodes

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() tries migration even if the target node is invalid. If users mistakenly make such invalid requests via DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can hap…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:06.479Z. Updated 2026-05-11T21:34:34.216Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39699

iommu/riscv: prevent NULL deref in iova_to_phys

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: prevent NULL deref in iova_to_phys The riscv_iommu_pte_fetch() function returns either NULL for unmapped/never-mapped iova, or a valid leaf pte pointer that requires no further validation. riscv_iommu_iova_to_phys() failed to handle NUL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:05.379Z. Updated 2026-05-11T21:34:33.067Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39698

io_uring/futex: ensure io_futex_wait() cleans up properly on failure

In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:04.360Z. Updated 2026-08-05T12:04:39.909Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39697

NFS: Fix a race when updating an existing write

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:03.178Z. Updated 2026-10-15T01:08:03.870Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:08 WIB

Official record