Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 6661–6680 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74421

drm/rockchip: dw_dp: Switch to drmm_kzalloc()

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw_dp: Switch to drmm_kzalloc() Driver makes use of drmm_encoder_init() to initialize the encoder and automatically handle the cleanup by registering drm_encoder_cleanup() with drmm_add_action(). However, the internal structure contain…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:25.328Z. Updated 2026-08-17T05:19:06.310Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74420

drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges VMAs marked with VM_IO or VM_PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get_pages() relies on hmm_range_fa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 6661 to 6680 of 12259.First page Next page

Published 2026-08-15T05:59:24.704Z. Updated 2026-08-17T05:19:04.353Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74419

accel/amdxdna: Adjust size for copy_to_user()

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Adjust size for copy_to_user() The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits instead of failin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:24.079Z. Updated 2026-08-17T05:46:59.744Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:46 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74418

dma-fence: Fix potential tracepoint null pointer dereferences

In the Linux kernel, the following vulnerability has been resolved: dma-fence: Fix potential tracepoint null pointer dereferences Trace_dma_fence_signaled, trace_dma_fence_wait_end and trace_dma_fence_destroy can all currently dereference a null fence->ops pointer after it has been reset on fence signalling. Lets us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:23.440Z. Updated 2026-08-17T05:19:01.013Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:19 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74417

drm/radeon: fix integer overflow in radeon_align_pitch()

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon_align_pitch() radeon_align_pitch() has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned * cpp' calculation can overflow signed int. If that wr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:22.731Z. Updated 2026-10-16T19:05:44.717Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74416

drm/radeon: fix memory leak in radeon_ring_restore() on lock failure

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure radeon_ring_restore() takes ownership of the data buffer allocated by radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in the non-restore branch; in the restore b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:22.077Z. Updated 2026-08-17T05:18:58.660Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74415

spi: atcspi200: fix use-after-free when driver unbind

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still alive and triggers DMA t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:21.378Z. Updated 2026-08-17T05:18:57.554Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74414

hfsplus: Remove the duplicate attr inode dirty marking action

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in [1]. If the attributes file is not loaded during system mount, a trigger occurs [1] when setxattr is executed in userspace. Remove the first mark attr …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:20.699Z. Updated 2026-08-17T05:18:56.466Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74413

wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pci_get_drvdata type in AER handlers rtw89 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:20.021Z. Updated 2026-10-16T19:05:44.523Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74412

wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pci_get_drvdata type in AER handlers rtw88 stores an ieee80211_hw pointer via pci_set_drvdata() at probe time, but io_error_detected() and io_resume() retrieve it as a net_device pointer. This causes netif_device_detach/attach…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:19.354Z. Updated 2026-10-16T19:05:44.326Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74411

wifi: rtw89: Correct data type for scan index to avoid infinite loop

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds, leading to a system panic. RIP poi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:18.696Z. Updated 2026-10-16T19:05:44.122Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74410

wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both firmware-controlled). The result…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:18.039Z. Updated 2026-10-16T19:05:43.968Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74409

wifi: rtw89: add bounds check on firmware mac_id in link lookup

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac_id in link lookup The mac_id field in RX descriptors is 8 bits wide (0-255), but assoc_link_on_macid[] has only RTW89_MAX_MAC_ID_NUM (128) entries. While the driver currently assigns mac_id values below 1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:17.361Z. Updated 2026-10-16T19:05:43.801Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74408

wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:16.701Z. Updated 2026-10-16T19:05:43.633Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74407

wifi: ath11k: cancel SSR work items during PCI shutdown

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cancel SSR work items during PCI shutdown A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts. Sim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:16.044Z. Updated 2026-10-21T12:45:39.446Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

CritPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74406

vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running. Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:15.385Z. Updated 2026-10-16T19:05:43.336Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74405

OPP: Fix race between OPP addition and lookup

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup A race exists between dev_pm_opp_add_dynamic() and dev_pm_opp_find_freq_exact(): CPU0 (add) CPU1 (lookup) ------------------------------- ------------------------------ …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:14.719Z. Updated 2026-10-21T12:45:38.343Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:45 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74404

crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one Sashiko notes: > regarding the bounds check in snp_filter_reserved_mem_regions() > called via walk_iomem_res_desc(): does the check > if ((range_list->num_elements * 16 + 8) > PAGE_SIZE)…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:14.073Z. Updated 2026-10-16T19:05:43.034Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Oct 2026, 02:05 WIB

Official record

HighPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74403

crypto: ccp - Check for page allocation failure correctly in TIO

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Check for page allocation failure correctly in TIO Sashiko notes: > if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it > safe to pass it directly to page_address()? > > On architectures without HASHED_PAGE_VIRTUA…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:13.399Z. Updated 2026-08-17T05:46:45.328Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:46 WIB

Official record

UnscoredPublished 15 Aug 2026, 12:59 WIB

CVE-2026-74402

crypto: atmel-sha204a - fix blocking and non-blocking rng logic

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the 32 bytes of random da…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-15T05:59:12.747Z. Updated 2026-08-17T05:18:42.284Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Aug 2026, 12:18 WIB

Official record