Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6501–6520 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74561

nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:04.525Z. Updated 2026-10-15T10:09:15.073Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:09 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74560

xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx This patch is inspired by the check[1] from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole process of pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 6501 to 6520 of 12259.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:03.912Z. Updated 2026-10-21T12:45:58.392Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74559

xsk: drain continuation descs after overflow in xsk_build_skb()

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xsk_build_skb() Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:03.279Z. Updated 2026-10-21T12:45:57.288Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74558

xsk: reclaim invalid Tx descriptors in ZC batch path

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are nei…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:02.628Z. Updated 2026-10-21T12:45:56.189Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74557

scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the target-supplied data segment. The segment carries a 2-byte sense length followed by the sense bytes, so it must hol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:01.988Z. Updated 2026-10-16T19:05:55.724Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

CritPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74556

scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:01.359Z. Updated 2026-10-16T19:05:55.568Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74555

scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock: the PHYE_RESUME_TIMEOUT handler, running o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:00.729Z. Updated 2026-08-19T16:38:54.912Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

HighPublished 15 Aug 2026, 19:28 WIB

CVE-2026-74554

wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:28:00.097Z. Updated 2026-10-16T19:05:55.415Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74553

hwmon: (nct6775-core) Fix number of temperature registers for NCT6116

In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 Unlike NCT6106, NCT6116 only has three temperature registers, and with it only three temperature source and temperature source configuration registers. The register addresses match…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:59.472Z. Updated 2026-08-19T16:38:52.272Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74552

hwmon: (lm90) Only report alarms if driver is ready

In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Only report alarms if driver is ready Userspace can read sysfs attributes before driver registration is complete, immediately after devm_hwmon_device_register_with_info() has been called. At that time, data->hwmon_dev is not yet initial…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:58.829Z. Updated 2026-08-19T16:38:49.811Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74551

hwmon: (nzxt-smart2) DMA-align output buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) DMA-align output buffer Sashiko reports: When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA. When the DMA mapping flushes or inv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:58.237Z. Updated 2026-08-19T16:38:47.362Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74550

net: do not send ICMP/NDISC Redirects when peer allocation fails

In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when peer allocation fails When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry under memory pressure or tree size caps, redirect handlers previously fell back to sending un-rate-limited ICM…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:57.615Z. Updated 2026-10-16T19:05:55.243Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74549

hwmon: (nct6775-core) Prevent access to unsupported weight registers

In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775-core) Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data->pwm_num to 5. However, it assigns several NCT6106 register arrays (such as NCT6106_REG_WEIGHT_DUTY…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:56.993Z. Updated 2026-08-19T16:38:42.442Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74548

forcedeth: fix UAF of txrx_stats in nv_remove

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:56.387Z. Updated 2026-10-16T19:05:55.094Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74547

hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread

In the Linux kernel, the following vulnerability has been resolved: hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread When userspace configures 'auto_update_interval' to 0 via sysfs, the background kthread executes schedule_timeout_interruptible(0), which returns immediately. If 'num_temp_sensors' is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:55.777Z. Updated 2026-08-19T16:38:37.219Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74546

hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read

In the Linux kernel, the following vulnerability has been resolved: hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FAN_DATA_VALID() check and the FAN_PERIOD_TO_RPM() conversion, it will result in a divide-by-zero crash due to a race with a concurrent update of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:55.147Z. Updated 2026-08-19T16:38:34.886Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74545

rtase: fix double free of multi-frag skb on DMA map failure

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:54.536Z. Updated 2026-08-17T05:48:32.121Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:48 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74544

net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:53.941Z. Updated 2026-10-21T12:45:54.992Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74543

net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()

In the Linux kernel, the following vulnerability has been resolved: net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() syzbot reported a memory leak [1] in the UDP tunnel NIC offload code. When device registration fails (e.g. in register_netdevice()), netdev core unwinds by sending a single NETDEV_UNREG…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:53.336Z. Updated 2026-10-21T12:45:53.873Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74542

netfs: Fix folio_queue ENOMEM in writeback by adding a mempool

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:52.741Z. Updated 2026-10-21T12:45:52.776Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record