Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 641–660 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38453

io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU

In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed: CPU: 1 UID: 0 PID: 19356 Comm: iou-wrk-19354 Not tainted 6.16.0-rc4-syzkaller-00108-g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:33.374Z. Updated 2026-08-05T12:02:00.377Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:02 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38452

net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe()

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() Add check for the return value of rcar_gen4_ptp_alloc() to prevent potential null pointer dereference.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 641 to 660 of 3774.First page Next page

Published 2025-07-25T15:27:32.709Z. Updated 2026-05-11T21:28:16.887Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38451

md/md-bitmap: fix GPF in bitmap_get_stats()

In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap_get_stats() The commit message of commit 6ec1f0239485 ("md/md-bitmap: fix stats collection for external bitmaps") states: Remove the external bitmap check as the statistics should be available regardless of bi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:32.045Z. Updated 2026-10-15T01:07:15.964Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38450

wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() Add a NULL check for msta->vif before accessing its members to prevent a kernel panic in AP mode deployment. This also fix the issue reported in [1]. The crash oc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:31.372Z. Updated 2026-05-11T21:28:14.325Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

HighPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38449

drm/gem: Acquire references on GEM handles for framebuffers

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:30.702Z. Updated 2026-10-15T21:52:16.382Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38448

usb: gadget: u_serial: Fix race condition in TTY wakeup

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix race condition in TTY wakeup A race condition occurs when gs_start_io() calls either gs_start_rx() or gs_start_tx(), as those functions briefly drop the port_lock for usb_ep_queue(). This allows gs_close() and gserial_disco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:30.040Z. Updated 2026-05-11T21:28:12.055Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

HighPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38447

mm/rmap: fix potential out-of-bounds page table access during batched unmap

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix potential out-of-bounds page table access during batched unmap As pointed out by David[1], the batched unmap logic in try_to_unmap_one() may read past the end of a PTE table when a large folio's PTE mappings are not fully contained withi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:29.360Z. Updated 2026-08-05T12:01:58.222Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:01 WIB

Official record

HighPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38446

clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data

In the Linux kernel, the following vulnerability has been resolved: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:28.699Z. Updated 2026-08-05T12:01:57.158Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:01 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38445

md/raid1: Fix stack memory use after return in raid1_reshape

In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape function, newpool is allocated on the stack and assigned to conf->r1bio_pool. This results in conf->r1bio_pool.wait.head pointing to a stack address. Accessing this add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:28.035Z. Updated 2026-05-11T21:28:08.626Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38444

raid10: cleanup memleak at raid10_make_request

In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_request registers a new request and the REQ_NOWAIT flag is set, the code does not free the malloc from the mempool. unreferenced object 0xffff8884802c3200 (size 19…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:27.336Z. Updated 2026-05-23T15:59:45.884Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:59 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38443

nbd: fix uaf in nbd_genl_connect() error path

In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:26.671Z. Updated 2026-05-11T21:28:06.374Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38442

block: reject bs > ps block devices when THP is disabled

In the Linux kernel, the following vulnerability has been resolved: block: reject bs > ps block devices when THP is disabled If THP is disabled and when a block device with logical block size > page size is present, the following null ptr deref panic happens during boot: [ [13.2 mK AOSAN: null-ptr-deref in range …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:26.009Z. Updated 2026-05-11T21:28:05.220Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38441

netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:20.276Z. Updated 2026-05-23T15:59:44.778Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:59 WIB

Official record

HighPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38440

net/mlx5e: Fix race between DIM disable and net_dim()

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks the DIM state bit and sees it still set, it assumes `rq->dim` or `sq->dim` is valid. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:19.447Z. Updated 2026-10-15T21:52:16.231Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

CritPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38439

bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:18.640Z. Updated 2026-10-15T21:52:16.081Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38438

ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: unreferenced object 0xffff88812391ff60 (size 16): comm "kw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:17.917Z. Updated 2026-05-11T21:27:59.571Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:27 WIB

Official record

HighPublished 25 Jul 2025, 22:27 WIB

CVE-2025-38437

ksmbd: fix potential use-after-free in oplock/lease break ack

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:27:16.995Z. Updated 2026-08-05T12:01:53.911Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:01 WIB

Official record

HighPublished 25 Jul 2025, 22:02 WIB

CVE-2025-8160

Tenda AC20 httpd SetSysTimeCfg buffer overflow

A vulnerability classified as critical has been found in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/SetSysTimeCfg of the component httpd. The manipulation of the argument timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclose…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T15:02:07.280Z. Updated 2025-07-25T15:11:10.192Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Jul 2025, 22:11 WIB

Official record

UnscoredPublished 25 Jul 2025, 21:32 WIB

CVE-2025-38436

drm/scheduler: signal scheduled fence when kill job

In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: signal scheduled fence when kill job When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a schedule…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T14:32:09.945Z. Updated 2026-05-11T21:27:57.212Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:27 WIB

Official record

HighPublished 25 Jul 2025, 21:32 WIB

CVE-2025-38435

riscv: vector: Fix context save/restore with xtheadvector

In the Linux kernel, the following vulnerability has been resolved: riscv: vector: Fix context save/restore with xtheadvector Previously only v0-v7 were correctly saved/restored, and the context of v8-v31 are damanged. Correctly save/restore v8-v31 to avoid breaking userspace.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-25T14:32:09.136Z. Updated 2026-08-05T12:01:52.506Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:01 WIB

Official record