Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3021–3040 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74679

usb: gadget: f_ncm: Use unsigned int for ndp_index

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large offset that overflows the signed ndp_index…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:47.499Z. Updated 2026-08-22T15:32:47.499Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74678

net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_start_xmit() treats a NULL return from tx…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3021 to 3040 of 12259.First page Next page

Published 2026-08-22T15:32:46.765Z. Updated 2026-10-16T19:16:08.884Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74677

net: usb: ipheth: fix carrier_work UAF on disconnect

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties that to the interface being up, so the work…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:46.001Z. Updated 2026-08-22T15:32:46.001Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74676

vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode on a non-controlling console without au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:45.256Z. Updated 2026-08-25T05:23:18.083Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:23 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74675

vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. Use tty_port_tty_get()/tty_kref_put() to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:44.493Z. Updated 2026-10-16T19:16:08.728Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74674

mm: fix incorrect flush address in direct page table reclaim

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zap_pte_range reclaims a page table, it does: pte_free_tlb(tlb, pmd_pgtable(pmdval), addr); and this is unconditionally wrong: if this code executes, addr *always* points one pas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:43.670Z. Updated 2026-08-25T05:41:26.569Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:41 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74673

Input: evdev - fix information leak in evdev_pass_values()

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev_pass_values() In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_ev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:42.941Z. Updated 2026-08-25T05:23:15.607Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:23 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74672

mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where no exclusion is re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:42.210Z. Updated 2026-08-23T12:47:58.392Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Aug 2026, 19:47 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74671

ima: fix out-of-bounds read in xattr_verify()

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr_verify() The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length) sizeof() yields size_t, so the usual arithmetic conv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:41.480Z. Updated 2026-08-22T15:32:41.480Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74670

ipvs: stop estimator after disabled calc phase

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs->enable during that phase, ip_vs_est_calc_phase(…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:40.850Z. Updated 2026-08-25T05:41:25.343Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:41 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74669

ipvs: clear IPv4 options after rebasing tunnel ICMP errors

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header. A ti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:40.221Z. Updated 2026-10-16T19:16:08.572Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74668

packet: use consistent hard_header_len in TX_RING send path

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in TX_RING send path tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfiguration can therefore make the reserved …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:39.583Z. Updated 2026-10-16T19:16:08.423Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74667

net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket, any SOCK_DGRAM frame, and the legacy SO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:38.862Z. Updated 2026-10-16T19:16:08.261Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74666

packet: synchronize pressure clearing with ring reconfiguration

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func after releasing that lock. packet_poll() …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:38.098Z. Updated 2026-10-16T19:16:08.102Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74665

net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies xdp_frags_size back to skb->data_len but…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:37.346Z. Updated 2026-08-25T05:41:19.196Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:41 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74664

net: openvswitch: reallocate update replies for mismatched IDs

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovs_flow_cmd_new() preallocates the optional reply skb before it takes ovs_mutex and before it knows which existing flow will be updated. That is normally fine because the skb is sized f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:36.616Z. Updated 2026-08-22T15:32:36.616Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74663

net/sched: reject overly deep qdisc hierarchies

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a hierarchy can still be e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:35.871Z. Updated 2026-10-16T19:16:07.950Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74662

inet: frags: publish queues before arming timer

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is publis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:35.151Z. Updated 2026-10-16T19:16:07.802Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74661

mac802154: fix netdev use-after-free in beacon worker

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the embedded wpan_d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:34.414Z. Updated 2026-08-25T05:41:15.528Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:41 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74660

netfilter: ebt_nflog: pin the NFLOG backend

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:33.677Z. Updated 2026-10-16T19:16:07.659Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:16 WIB

Official record