Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 3081–3100 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74619

ovl: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfig(FSCONFIG_CMD_CREATE) to the task…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:03.511Z. Updated 2026-08-22T15:32:03.511Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74618

binfmt_misc: don't warn when the mount is completed from another user namespace

In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfig(FSCONFIG_CMD_CREATE) to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3081 to 3100 of 12259.First page Next page

Published 2026-08-22T15:32:02.778Z. Updated 2026-08-22T15:32:02.778Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2026, 22:32 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74617

dibs: initialise dibs->lock in dibs_dev_alloc()

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_irq(), before it calls dibs_dev_add(). No …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:02.049Z. Updated 2026-10-16T19:06:02.395Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

CritPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74616

xdp: reject clones that overrun skb_shared_info tailroom

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_sha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:01.313Z. Updated 2026-10-16T19:06:02.219Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:32 WIB

CVE-2026-74615

vxlan: do not arm the ageing timer on a device that is down

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:32:00.588Z. Updated 2026-10-16T19:06:02.032Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74614

vsock/virtio: read virtqueues under worker locks

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event worker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:59.800Z. Updated 2026-10-16T19:06:01.847Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74613

vsock/virtio: avoid refilling the RX queue after teardown

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rx_run is clear. That exit still refills the RX queue when the buffer c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:59.062Z. Updated 2026-10-16T19:06:01.547Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

CritPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74612

veth: fix skb length accounting after XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp_frags_size back to skb->data_len but leaves skb->len conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:58.295Z. Updated 2026-10-16T19:06:01.379Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

CritPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74611

tls: rx: restore msg_iter before TLS 1.3 optimistic retry

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:57.534Z. Updated 2026-10-21T12:46:05.035Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74610

tls: don't leave a full plaintext sk_msg ring unpushed

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk_msg ring unpushed When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so the record is left full and unpushed. A later splice() then …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:56.813Z. Updated 2026-08-25T05:40:36.026Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:40 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74609

tipc: read le->link under the node lock in tipc_node_link_down()

In the Linux kernel, the following vulnerability has been resolved: tipc: read le->link under the node lock in tipc_node_link_down() tipc_node_link_down() caches the link pointer before taking n->lock: struct tipc_link *l = le->link; /* unlocked */ if (!l) return; tipc_node_write_lock(n); if (!tipc_link_is_e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:56.054Z. Updated 2026-10-16T19:06:01.059Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

CritPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74608

smb: client: Fix use-after-free in cifs_try_adding_channels()

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fails, it drops that reference and then increments iface->weigh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:55.298Z. Updated 2026-10-16T19:06:00.915Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74607

KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate issues: - in sev_migrate_from(), when the destination KVM i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:54.554Z. Updated 2026-10-16T19:06:00.756Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74606

eventfs: Fix use-after-free in eventfs_remove_rec()

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If fre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:53.819Z. Updated 2026-08-25T05:40:31.060Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:40 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74605

eventfs: Use children field for rcu head and add memory barriers

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:53.063Z. Updated 2026-10-21T12:46:03.903Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74604

Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit") that introduced a use-after-free into the error path of thermal_add_hwmon_sysfs() by removing a valid check fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:52.295Z. Updated 2026-10-16T19:06:00.603Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74603

ptp: ocp: Fix board ID over-read

In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats it as a C string and may read beyond the field. Format at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:51.544Z. Updated 2026-08-25T05:40:27.399Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 12:40 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74602

ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if when freed: free_buffer_page() reli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:50.811Z. Updated 2026-08-23T12:47:43.108Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Aug 2026, 19:47 WIB

Official record

HighPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74601

ring-buffer: Use current_context for safe per-CPU buffer swap

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Use current_context for safe per-CPU buffer swap The ring_buffer_swap_cpu() function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before performing the swap. However, there exists …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:50.092Z. Updated 2026-10-16T19:06:00.447Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:06 WIB

Official record

UnscoredPublished 22 Aug 2026, 22:31 WIB

CVE-2026-74600

mm/page_table_check: skip special zero mappings

In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: skip special zero mappings page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but page_table_check can still account them as f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-22T15:31:49.334Z. Updated 2026-10-21T12:46:02.782Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:46 WIB

Official record