Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 5241–5260 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23454

net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown

In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown A potential race condition exists in mana_hwc_destroy_channel() where hwc->caller_ctx is freed before the HWC's Completion Queue (CQ) and Event Queue (EQ) are destroye…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:36.189Z. Updated 2026-10-15T01:15:14.968Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:15 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23453

net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode Page recycling was removed from the XDP_DROP path in emac_run_xdp() to avoid conflicts with AF_XDP zero-copy mode, which uses xsk_buff_free() instead. However, this causes a m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 5241 to 5260 of 5813.First page Next page

Published 2026-04-03T15:15:35.549Z. Updated 2026-08-05T12:21:53.011Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23452

PM: runtime: Fix a race condition related to device removal

In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe the parent is now able to suspend. */ if (parent && !paren…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:34.680Z. Updated 2026-10-15T01:15:13.091Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:15 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23451

bonding: prevent potential infinite loop in bond_header_parse()

In the Linux kernel, the following vulnerability has been resolved: bonding: prevent potential infinite loop in bond_header_parse() bond_header_parse() can loop if a stack of two bonding devices is setup, because skb->dev always points to the hierarchy top. Add new "const struct net_device *dev" parameter to (struct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:33.776Z. Updated 2026-08-05T12:21:51.936Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:21 WIB

Official record

CritPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23450

net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:33.144Z. Updated 2026-10-19T18:35:44.407Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23449

net/sched: teql: Fix double-free in teql_master_xmit

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following: [ 2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:32.150Z. Updated 2026-10-19T18:35:44.234Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23448

net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:31.488Z. Updated 2026-09-14T11:58:15.009Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Sep 2026, 18:58 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23447

net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check

In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:30.495Z. Updated 2026-09-14T11:58:13.940Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Sep 2026, 18:58 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23446

net: usb: aqc111: Do not perform PM inside suspend callback

In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports "task hung in rpm_resume" This is caused by aqc111_suspend calling the PM variant of its write_cmd routine. The simplified call trace looks like this: rpm_suspend() usb_s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:29.863Z. Updated 2026-10-15T01:15:07.658Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:15 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23445

igc: fix page fault in XDP TX timestamps handling

In the Linux kernel, the following vulnerability has been resolved: igc: fix page fault in XDP TX timestamps handling If an XDP application that requested TX timestamping is shutting down while the link of the interface in use is still up the following kernel splat is reported: [ 883.803618] [ T1554] BUG: unable …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:29.194Z. Updated 2026-10-19T18:35:44.084Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23444

wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:28.464Z. Updated 2026-10-19T18:35:43.925Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23443

ACPI: processor: Fix previous acpi_processor_errata_piix4() fix

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix previous acpi_processor_errata_piix4() fix After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()"), device pointers may be dereferenced after dropping references to the device o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:27.698Z. Updated 2026-05-11T22:07:00.396Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:07 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23442

ipv6: add NULL checks for idev in SRv6 paths

In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_valid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:26.851Z. Updated 2026-10-15T01:15:04.465Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:15 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23441

net/mlx5e: Prevent concurrent access to IPSec ASO context

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent concurrent access to IPSec ASO context The query or updating IPSec offload object is through Access ASO WQE. The driver uses a single mlx5e_ipsec_aso struct for each PF, which contains a shared DMA-mapped context for all ASO operat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:25.380Z. Updated 2026-05-11T22:06:58.123Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:06 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23440

net/mlx5e: Fix race condition during IPSec ESN update

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race condition during IPSec ESN update In IPSec full offload mode, the device reports an ESN (Extended Sequence Number) wrap event to the driver. The driver validates this event by querying the IPSec ASO and checking that the esn_event…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:24.596Z. Updated 2026-10-19T18:35:43.781Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23439

udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n

In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:23.734Z. Updated 2026-10-15T01:15:01.223Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:15 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23438

net: mvpp2: guard flow control update with global_tx_fc in buffer switching

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer switching mvpp2_bm_switch_buffers() unconditionally calls mvpp2_bm_pool_update_priv_fc() when switching between per-cpu and shared buffer pool modes. This function programs CM3 flow co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:22.701Z. Updated 2026-10-15T01:14:58.956Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

HighPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23437

net: shaper: protect late read accesses to the hierarchy

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:22.048Z. Updated 2026-10-19T18:35:43.629Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23436

net: shaper: protect from late creation of hierarchy

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect from late creation of hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. The netdev ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:21.280Z. Updated 2026-05-11T22:06:52.320Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:06 WIB

Official record

UnscoredPublished 03 Apr 2026, 22:15 WIB

CVE-2026-23435

perf/x86: Move event pointer setup earlier in x86_pmu_enable()

In the Linux kernel, the following vulnerability has been resolved: perf/x86: Move event pointer setup earlier in x86_pmu_enable() A production AMD EPYC system crashed with a NULL pointer dereference in the PMU NMI handler: BUG: kernel NULL pointer dereference, address: 0000000000000198 RIP: x86_perf_event_updat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-03T15:15:20.465Z. Updated 2026-05-23T16:04:50.015Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:04 WIB

Official record