Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3001–3020 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 22 Aug 2026, 22:33 WIB

CVE-2026-74699

drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Return an error if q->replay_state is not empty. Discovered …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:33:00.316Z. Updated 2026-08-22T15:33:00.316Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:33 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74698

net/mlx5e: fix BQL reset on SQ re-activation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3001 to 3020 of 12259.First page Next page

Published 2026-08-22T15:32:59.703Z. Updated 2026-08-22T15:32:59.703Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74697

bnxt_en: Disable EOP for TPA on all chips to prevent data corruption

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:59.073Z. Updated 2026-10-21T12:46:11.741Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74696

tcp: fix TFO max_qlen accounting across reuseport migration

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migrat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:58.414Z. Updated 2026-10-16T19:16:09.811Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74695

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:57.756Z. Updated 2026-10-21T12:46:10.628Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74694

net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band packet header, while the source buffer is the NCSI_ATTR_DATA ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:57.113Z. Updated 2026-08-22T15:32:57.113Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74693

net: prestera: validate firmware header length

In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera_fw_header before decoding the magic and version…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:56.491Z. Updated 2026-08-22T15:32:56.491Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74692

net/smc: fix TOCTOU race between smc_listen_out() and listener close

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:55.873Z. Updated 2026-10-16T19:16:09.513Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74691

net: thunderbolt: Tear down DMA paths before stopping the rings

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's descriptor base and tbnet_free_buffers() unm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:55.258Z. Updated 2026-08-25T05:41:36.384Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:41 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74690

s390/ism: Fix UAF of sba and ieq during ism_dev_exit()

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be generated after unregister_ieq(). Drain ongoing interrupt handle…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:54.650Z. Updated 2026-10-21T12:46:09.495Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74689

net/atm: fix slab-out-of-bounds read in vcc_setsockopt()

In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL; If __SO_LEVEL_MATCH(optname, level) evalua…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:54.034Z. Updated 2026-10-16T19:16:09.361Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74688

sctp: clear control chunk transport if it is being removed

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEARTBEAT ACK may remain queued on control_c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:53.423Z. Updated 2026-10-16T19:16:09.209Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74687

watchdog: at91sam9_wdt: prevent timer rearm during teardown

In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9_wdt: prevent timer rearm during teardown at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver removal can l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:52.792Z. Updated 2026-10-21T12:46:08.358Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74686

rqspinlock: Reset tail when preserving queue on deadlock

In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks happen relatively frequently (on entry for AA, within 1ms for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:52.178Z. Updated 2026-08-22T15:32:52.178Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74685

hwmon: (ltc4282) Clamp negative current limits

In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Clamp negative current limits When a negative value is passed to ltc4282_write_curr(), the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282_write_curr() { /* need to pass it in millivolt */ u3…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:51.493Z. Updated 2026-08-22T15:32:51.493Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74684

net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap_get_user() by assigning skb->dev before…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:50.846Z. Updated 2026-10-21T12:46:07.263Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74683

Input: evdev - sanitize event type index when fetching event masks

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:50.192Z. Updated 2026-08-25T05:23:19.336Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:23 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74682

ALSA: usb-audio: fix OOB write on Type II inbound URBs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u->packets = urb_packs; u->buffer_size = maxsize * u->packets; if (fmt->fmt_type == …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:49.527Z. Updated 2026-08-22T15:32:49.527Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74681

usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint size. Both are taken independently from di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:48.873Z. Updated 2026-08-22T15:32:48.873Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74680

usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted rcv_urb. This leaves the rcv_urb active.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:48.230Z. Updated 2026-08-22T15:32:48.230Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record