Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6581–6600 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74480

net: bridge: stop fast-leave after deleting a port group

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If mu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:13.803Z. Updated 2026-10-16T19:05:48.808Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74479

net: pktgen: fix proc entry use-after-free

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock. This allows the following interleaving: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6581 to 6600 of 12259.First page Next page

Published 2026-08-15T12:27:13.172Z. Updated 2026-10-16T19:05:48.651Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74478

um: vector: fix use-after-free in vector_mmsg_rx()

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kfree_skb_irq(skb); vp->estats.rx_encaps…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:12.549Z. Updated 2026-08-19T16:37:30.555Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:37 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74477

uprobes: Fix NULL pointer dereference in hprobe_expire()

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone() path: BUG: kernel NULL pointer dereference, address: 0000000000000018 Oops: 0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:11.938Z. Updated 2026-08-17T05:20:09.952Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:20 WIB

Official record

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74476

veth: convert frag_list skbs before running XDP

In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:11.309Z. Updated 2026-10-16T19:05:48.477Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74475

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn rea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:10.685Z. Updated 2026-10-16T19:05:48.322Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74474

vxlan: use pskb_network_may_pull() for transmit path header pulls

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). Ho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:10.037Z. Updated 2026-10-16T19:05:48.132Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

CritPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74473

vxlan: use pskb_network_may_pull() in route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:09.382Z. Updated 2026-10-16T19:05:47.966Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74472

ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()

In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into ub->dev_info and then fixes up the fields the driver owns, but misses ->state and ->ublksrv_pid. A device added wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:08.759Z. Updated 2026-08-19T16:37:23.182Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:37 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74471

tracing: Check return value of __register_event() in trace_module_add_events()

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:08.128Z. Updated 2026-10-16T19:05:47.824Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74470

scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write resp_report_zones() sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloc_len up with ALIGN() before deriving the descriptor count: rep_max_zones = (ALIGN((u6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:07.504Z. Updated 2026-10-16T19:05:47.666Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74469

sctp: prevent peer transport count overflow

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:06.873Z. Updated 2026-10-16T19:05:47.493Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74468

gpio: pch: use raw_spinlock_t for the register lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use raw_spinlock_t for the register lock pch_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is reached from __setup_irq() -> __irq_set_trigger() -> chip->ir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:06.250Z. Updated 2026-08-19T16:37:12.926Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:37 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74467

s390/qeth: Check CAP_NET_ADMIN for private ioctls

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOC_QETH_ADP_SET_SNMP_CONTROL, SIOC_QETH_GET_CARD_TYPE and SIOC_QETH_QUERY_OAT with CAP_NET_ADMIN capable check to ensure unprivileged users cannot invoke them.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:05.635Z. Updated 2026-10-16T19:05:47.339Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74466

s390/zcrypt: Close speculative mem read possibility

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, adm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:05.020Z. Updated 2026-10-21T12:45:41.662Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74465

net: openvswitch: fix potential UAF on meter attach failure

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach failure While attaching a newly created meter attach_meter() function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter back and returns an e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:04.403Z. Updated 2026-10-16T19:05:47.189Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74464

net: openvswitch: fix skb leak on flow key update failure during ct

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs_ct_execute() always steals or frees the skb on failure while ovs_flow_key_update() does not. So, if it fails and we return right away, the skb ends up leaked. Fix that by break…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:03.786Z. Updated 2026-08-19T16:37:05.367Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:37 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74463

i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock, which triggers when an I2C-controlled clock generator client (like the Si5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:03.176Z. Updated 2026-08-19T16:37:02.602Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:37 WIB

Official record

UnscoredPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74462

i2c: imx: mark I2C adapter when hardware is powered down

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a time window between: - sus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:02.548Z. Updated 2026-08-17T05:19:51.284Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

HighPublished 15 Aug 2026, 19:27 WIB

CVE-2026-74461

i2c: imx: Cancel hrtimer before clearing slave pointer

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2c_imx_unreg_slave(), the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer (i2c_imx_slave_timeout) before the poin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T12:27:01.924Z. Updated 2026-10-16T19:05:47.029Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record