Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6641–6660 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 15 Aug 2026, 13:00 WIB

CVE-2026-14230

ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-aut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T06:00:14.469Z. Updated 2026-08-17T20:40:06.972Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2026, 03:40 WIB

Official record

UnscoredPublished 15 Aug 2026, 13:00 WIB

CVE-2026-14229

ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6641 to 6660 of 12259.First page Next page

Published 2026-08-15T06:00:14.296Z. Updated 2026-08-17T20:41:10.110Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2026, 03:41 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74439

iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:36.655Z. Updated 2026-10-16T19:05:45.325Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74438

crypto: sun4i-ss - Remove insecure and unused rng_alg

In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng_alg Remove sun4i_ss_rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:36.044Z. Updated 2026-08-17T05:47:12.124Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74437

media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work If a UVC camera has an asynchronous control, uvc_status_stop may be called from async_ctrl.work: uvc_ctrl_status_event_work() uvc_ctrl_status_event() uvc_ctr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:35.297Z. Updated 2026-08-17T05:19:23.869Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74436

rxrpc: serialize kernel accept preallocation with socket teardown

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:34.687Z. Updated 2026-10-16T19:05:45.032Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74435

rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer must be allocated. However, rxrpc_verif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:34.073Z. Updated 2026-08-17T05:47:09.898Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74434

rxrpc: Don't move a peeked OOB message onto the pending queue

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, if a response is needed, moves it onto the pending_oobq tree. However, only the unlink from recvmsg_oobq is guarded b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:33.438Z. Updated 2026-08-17T05:47:08.797Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74433

rxrpc: Fix UAF in rxgk_issue_challenge()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix UAF in rxgk_issue_challenge() Fix rxgk_issue_challenge() to free the page containing the challenge content after invoking the tracepoint as the whdr passed to the tracepoint points into the page just freed.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:32.823Z. Updated 2026-08-17T05:47:07.711Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74432

rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) Fix rxrpc_recvmsg() to also drop the ref it holds on an already-released call if MSG_PEEK is in force (the function holds a ref on the call irrespective of whether MSG_PEEK is specified or not).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:32.207Z. Updated 2026-08-23T12:47:15.670Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Aug 2026, 19:47 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74431

rxrpc: Fix potential infinite loop in rxrpc_recvmsg()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpc_recvmsg() Fix the wait in rxrpc_recvmsg() also take check the oob queue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:31.586Z. Updated 2026-08-17T05:47:06.624Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74430

rxrpc: Fix ACKALL packet handling

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc_input_ackall() accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service call in RXRPC_CAL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:30.965Z. Updated 2026-08-17T05:47:05.522Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74429

rxrpc: Fix the reception of a reply packet before data transmission

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet before data transmission Fix rxrpc_receiving_reply() to handle the reception of an apparent reply DATA packet before rxrpc has had a chance to send any request DATA packets on a client call by checking to se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:30.286Z. Updated 2026-08-17T05:47:04.412Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74428

rxrpc: Fix double unlock in rxrpc_recvmsg()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix double unlock in rxrpc_recvmsg() Fix a double unlock in rxrpc_recvmsg() when dealing with OOB messages.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:29.668Z. Updated 2026-08-17T05:47:03.327Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74427

afs: Fix netns teardown to cancel the preallocation charger

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls are disabled (i.e. lis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:29.053Z. Updated 2026-10-16T19:05:44.869Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74426

afs: fix NULL pointer dereference in afs_get_tree()

In the Linux kernel, the following vulnerability has been resolved: afs: fix NULL pointer dereference in afs_get_tree() afs_alloc_sbi() uses kzalloc for memory allocation. And, if ctx->dyn_root is not null, as->cell and as->volume are null. In trace_afs_get_tree() they are dereferenced. KASAN error message: KASAN: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:28.427Z. Updated 2026-08-17T05:19:11.836Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74425

afs: handle CB.InitCallBackState3 requests without a server record

In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests without a server record The cache manager callback path now attaches the server record to an incoming call through the rxrpc peer's app data. That association is not guaranteed to exist for every callback r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:27.806Z. Updated 2026-08-17T05:47:00.844Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:47 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74424

fbcon: fix NULL pointer dereference for a console without vc_data

In the Linux kernel, the following vulnerability has been resolved: fbcon: fix NULL pointer dereference for a console without vc_data fbcon_new_modelist() runs when a framebuffer's modelist changes. For each console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and passes the vc_num to fbcon_set_dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:27.179Z. Updated 2026-08-18T06:56:33.340Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2026, 13:56 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74423

accel/amdxdna: Fix leak when pinning ubuf pages

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix leak when pinning ubuf pages When pin_user_pages_fast() returns fewer pages than requested, the pages that were successfully pinned are not released, leading to a leak. Fix this by unpinning any partially pinned pages before retur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:26.568Z. Updated 2026-08-17T05:19:08.522Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74422

drm/rockchip: inno-hdmi: Switch to drmm_kzalloc()

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: inno-hdmi: Switch to drmm_kzalloc() Driver makes use of drmm_encoder_init() to initialize the encoder and automatically handle the cleanup by registering drm_encoder_cleanup() with drmm_add_action(). However, the internal structure con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:25.955Z. Updated 2026-08-17T05:19:07.404Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record