Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3801–3820 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38696

MIPS: Don't crash in stack_top() for tasks without ABI or vDSO

In the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. Thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:48.973Z. Updated 2026-05-23T16:00:23.673Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:00 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38695

scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3801 to 3820 of 4319.First page Next page

Published 2025-09-04T15:32:48.168Z. Updated 2026-05-12T12:05:31.923Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:05 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38694

media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()

In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] witho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:47.449Z. Updated 2026-05-12T12:05:30.790Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:05 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38693

media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar

In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:46.726Z. Updated 2026-05-12T12:05:29.640Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:05 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38692

exfat: add cluster chain loop check for dir

In the Linux kernel, the following vulnerability has been resolved: exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop infinitely. - The cluster chain includes a loop. - Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:46.004Z. Updated 2026-05-11T21:33:08.662Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:33 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38691

pNFS: Fix uninited ptr deref in block/scsi layout

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the "layoutupdate_pages" page array is initializ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:45.301Z. Updated 2026-10-15T01:07:38.077Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38690

drm/xe/migrate: prevent infinite recursion

In the Linux kernel, the following vulnerability has been resolved: drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XE_CAHELINE_BYTES we fallback to using a bounce buffer. However the bounce buffer here is allocated on the stack, and the only alignment requirement here is that it's na…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:44.559Z. Updated 2026-05-11T21:33:06.104Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:33 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38689

x86/fpu: Fix NULL dereference in avx512_status()

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix NULL dereference in avx512_status() Problem ------- With CONFIG_X86_DEBUG_FPU enabled, reading /proc/[kthread]/arch_status causes a warning and a NULL pointer dereference. This is because the AVX-512 timestamp code uses x86_task_fpu() b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:43.530Z. Updated 2026-05-11T21:33:04.964Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:33 WIB

Official record

HighPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38688

iommufd: Prevent ALIGN() overflow

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:42.607Z. Updated 2026-10-15T22:02:28.092Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38687

comedi: fix race between polling and detaching

In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:41.702Z. Updated 2026-08-05T12:03:57.908Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38686

userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swp_entry_t. Add the missing check and let split_hu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:40.771Z. Updated 2026-05-11T21:33:01.310Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:33 WIB

Official record

HighPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38685

fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:39.856Z. Updated 2026-10-15T01:07:36.763Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38684

net/sched: ets: use old 'nbands' while purging unused classes

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:38.927Z. Updated 2026-05-23T16:00:22.602Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:00 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38683

hv_netvsc: Fix panic during namespace deletion with VF

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:38.215Z. Updated 2026-05-23T16:00:21.541Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:00 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38682

i2c: core: Fix double-free of fwnode in i2c_unregister_device()

In the Linux kernel, the following vulnerability has been resolved: i2c: core: Fix double-free of fwnode in i2c_unregister_device() Before commit df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device"), i2c_unregister_device() only called fwnode_handle_put() on of_node-s in the form of calling of_node_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:37.403Z. Updated 2026-05-11T21:32:56.493Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:32 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38681

mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd()

In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:36.681Z. Updated 2026-10-15T01:07:35.245Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

UnscoredPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38680

media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:35.963Z. Updated 2026-05-12T12:05:21.433Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 19:05 WIB

Official record

HighPublished 04 Sep 2025, 22:32 WIB

CVE-2025-38679

media: venus: Fix OOB read due to missing payload bound check

In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:32:35.131Z. Updated 2026-08-05T12:03:55.753Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

MedPublished 04 Sep 2025, 22:06 WIB

CVE-2025-25048

IBM Jazz Foundation path traversal

IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 could allow an authenticated user to upload files to the system due to improper neutralization of sequences that can resolve to a restricted directory.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:06:15.076Z. Updated 2025-09-04T15:16:08.257Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 22:16 WIB

Official record

MedPublished 04 Sep 2025, 22:04 WIB

CVE-2024-43184

IBM Jazz Foundation cross-site scripting

IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cred…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T15:04:57.324Z. Updated 2025-09-04T17:39:41.359Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated05 Sep 2025, 00:39 WIB

Official record