Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3461–3480 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39696

ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv During the conversion to unify the calibration data management, the reference to tasdevice_priv was wrongly set to h->hda_priv instead of h->priv. This resulted in memory corruption and crash…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:02.068Z. Updated 2026-08-05T12:04:37.787Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39695

RDMA/rxe: Flush delayed SKBs while releasing RXE resources

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Flush delayed SKBs while releasing RXE resources When skb packets are sent out, these skb packets still depends on the rxe resources, for example, QP, sk, when these packets are destroyed. If these rxe resources are released when the skb p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3461 to 3480 of 4319.First page Next page

Published 2025-09-05T17:21:01.198Z. Updated 2026-05-11T21:34:28.377Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

HighPublished 06 Sep 2025, 00:21 WIB

CVE-2025-39694

s390/sclp: Fix SCCB present check

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:21:00.361Z. Updated 2026-08-05T12:04:36.685Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39693

drm/amd/display: Avoid a NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:59.287Z. Updated 2026-05-12T12:06:19.646Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39692

smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()

In the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:58.349Z. Updated 2026-05-12T12:06:18.465Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

HighPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39691

fs/buffer: fix use-after-free when call bh_read() helper

In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:57.247Z. Updated 2026-10-15T22:02:30.511Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39690

iio: accel: sca3300: fix uninitialized iio scan data

In the Linux kernel, the following vulnerability has been resolved: iio: accel: sca3300: fix uninitialized iio scan data Fix potential leak of uninitialized stack data to userspace by ensuring that the `channels` array is zeroed before use.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:56.139Z. Updated 2026-05-11T21:34:22.453Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

HighPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39689

ftrace: Also allocate and copy hash for reading of filter files

In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:55.270Z. Updated 2026-10-15T22:02:30.348Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39687

iio: light: as73211: Ensure buffer holes are zeroed

In the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:54.154Z. Updated 2026-05-12T12:06:14.761Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39686

comedi: Make insn_rw_emulate_bits() do insn->n samples

In the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:53.071Z. Updated 2026-05-12T12:06:13.615Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39685

comedi: pcl726: Prevent invalid irq number

In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:51.954Z. Updated 2026-05-12T12:06:12.481Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39684

comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:50.827Z. Updated 2026-05-12T12:06:11.333Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record

HighPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39683

tracing: Limit access to parser->buffer when trace_get_user failed

In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:49.821Z. Updated 2026-10-15T22:02:30.066Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

CritKEVPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39682

tls: fix handling of zero-length records on the rx_list

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-09-05T17:20:48.657Z. Updated 2026-10-07T17:56:14.826Z.

CVSS9.8v3.1KEVListedEPSSPresentUpdated08 Oct 2026, 00:56 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39681

x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:47.564Z. Updated 2026-10-15T01:07:57.889Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

HighPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39680

i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug. Fix this bug by checking the value of data->block[0] first…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:46.456Z. Updated 2026-08-05T12:04:30.326Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:04 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39679

drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). When the nvif_vmm_type is invalid, we will return error directly without freeing the args in nvif_vmm_ctor(), which leading a memory leak. Fix it by setting the ret -EINVAL and goto done…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:45.357Z. Updated 2026-05-11T21:34:09.528Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39678

platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL If metric table address is not allocated, accessing metrics_bin will result in a NULL pointer dereference, so add a check.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:44.246Z. Updated 2026-05-11T21:34:08.354Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:34 WIB

Official record

HighPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39677

net/sched: Fix backlog accounting in qdisc_dequeue_internal

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The problem is the following in the values pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:43.145Z. Updated 2026-10-21T12:37:15.872Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

UnscoredPublished 06 Sep 2025, 00:20 WIB

CVE-2025-39676

scsi: qla4xxx: Prevent a potential error pointer dereference

In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-05T17:20:42.270Z. Updated 2026-05-12T12:06:06.474Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:06 WIB

Official record