Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3061–3080 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74639

ALSA: us144mkii: re-anchor capture URBs on resubmission

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture_urb_complete() resubmits each capture URB without anchoring it: usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC); Anchoring is a property of a submission, not of the URB. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:18.236Z. Updated 2026-08-22T15:32:18.236Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74638

drm/v3d: Serialize the scheduler timeout handlers

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues (BIN, RENDER, TFU and CSD) but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart the schedulers of ev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3061 to 3080 of 12259.First page Next page

Published 2026-08-22T15:32:17.509Z. Updated 2026-08-25T05:23:13.123Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:23 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74637

perf/core: Fix group leader use-after-free after sibling detach

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is rese…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:16.755Z. Updated 2026-10-16T19:06:04.262Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74636

tracing: Fix race between update_event_fields and, event_define_fields

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and, event_define_fields The following sequence may leads race between event_define_fields() and update_event_fields(): CPU0 (loads module A) CPU1 (loads module B) ================…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:16.026Z. Updated 2026-08-22T15:32:16.026Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74635

fbdev: bitblit: bound-check glyph index in bit_cursor()

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_cursor() bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where charmask is 0x1ff when vc_hi_font_mask is set. The scree…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:15.280Z. Updated 2026-10-16T19:06:04.057Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74634

ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Retur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:14.547Z. Updated 2026-08-25T05:40:58.185Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:40 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74633

tracing: Fix NULL pointer dereference in module event cache removal

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL event_mod->match when foo has not been loaded. If a later write tries to remove a specific match from the same mod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:13.808Z. Updated 2026-08-22T15:32:13.808Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74632

mm/huge_memory: fix huge_zero_pfn race

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fails to account for the fact that the shri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:13.078Z. Updated 2026-10-16T19:06:03.913Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74631

net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:12.334Z. Updated 2026-10-16T19:06:03.774Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74630

ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The incre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:11.596Z. Updated 2026-10-16T19:06:03.622Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74629

net/dibs: Correct freeing of dmb_clientid_arr

In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:10.861Z. Updated 2026-10-16T19:06:03.413Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74628

net/x25: fix use-after-free of the socket by its timers

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on anot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:10.135Z. Updated 2026-08-27T12:39:49.703Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:39 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74627

net: devmem: prevent net-iov / page mixing

In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have net_iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy_fill_skb_from_devmem().

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:09.405Z. Updated 2026-08-25T05:40:50.784Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:40 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74626

NTB: ntb_netdev: Preserve RX queue depth on allocation failure

In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted. Every failure therefore takes one buff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:08.687Z. Updated 2026-10-16T19:06:03.263Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74625

netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:07.929Z. Updated 2026-10-16T19:06:03.037Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74624

netfilter: nf_conntrack: defer invalid log until after unlock

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:07.193Z. Updated 2026-10-16T19:06:02.842Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74623

net: atlantic: free stranded TX buffers on ring deinit

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_head, which no longer moves once aq_vec_sto…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:06.467Z. Updated 2026-08-23T12:47:48.573Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Aug 2026, 19:47 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74622

net: atlantic: free RX pages of consumed but not refilled buffers

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page (and its DMA mapping) in t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:05.719Z. Updated 2026-08-22T15:32:05.719Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74621

net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (family == NFPROTO_IPV4) err = tcf_ct_ipv4_is_fragment(sk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:04.990Z. Updated 2026-10-16T19:06:02.607Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74620

net/sched: act_gact, act_police: range check the fallback control action

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0; TC_ACT_VALUE_MAX is TC_ACT_TRAP, so kernel-i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:04.254Z. Updated 2026-08-23T12:47:46.379Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Aug 2026, 19:47 WIB

Official record